5b40b8f968e30a704254f31197f7530c59ea26e81de2d32e6678f18d227645f3

Resubmissions

26/12/2022, 16:29

26/12/2022, 05:20

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2022, 16:29

Target

UpdatedFiles/NewInvoice.dll
Size

817KB
MD5

7f1ec89288b47335f996b50907bc5280
SHA1

dc58e0658fdd33a00e9699acbad6fdeb15daf1c8
SHA256

670cb4fded7498acfb990704b499cba6907bc279341dd7302ac526b715462c9f
SHA512

77b008ac80f995bcb102ddac715724928d56c8dd41bff1c1f0109e3691942637a0a592deb892e5c9d6ab866c1a3b07a91218d85a60496baa132a9ed23ed19f6f
SSDEEP

12288:JJGwvTfCMf8rVomRle7XBr4fi7wDqo4TARMhxMrFND648j4xhT6Tl:JY5rVtcsfi7wDP4TAR0sFN+Ux

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2256	680	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 680	3440	rundll32.exe	81
PID 3440 wrote to memory of 680	3440	rundll32.exe	81
PID 3440 wrote to memory of 680	3440	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UpdatedFiles\NewInvoice.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\UpdatedFiles\NewInvoice.dll,#1
  2⤵
  PID:680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 680 -s 612
    3⤵
    - Program crash
    PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 680 -ip 680
1⤵
PID:4532