5b40b8f968e30a704254f31197f7530c59ea26e81de2d32e6678f18d227645f3

Resubmissions

26-12-2022 16:29

26-12-2022 05:20

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2022 16:29

Target

UpdatedFiles/NewInvoice.dll
Size

817KB
MD5

7f1ec89288b47335f996b50907bc5280
SHA1

dc58e0658fdd33a00e9699acbad6fdeb15daf1c8
SHA256

670cb4fded7498acfb990704b499cba6907bc279341dd7302ac526b715462c9f
SHA512

77b008ac80f995bcb102ddac715724928d56c8dd41bff1c1f0109e3691942637a0a592deb892e5c9d6ab866c1a3b07a91218d85a60496baa132a9ed23ed19f6f
SSDEEP

12288:JJGwvTfCMf8rVomRle7XBr4fi7wDqo4TARMhxMrFND648j4xhT6Tl:JY5rVtcsfi7wDP4TAR0sFN+Ux

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2256 680 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2256	680	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3440 wrote to memory of 680	3440	rundll32.exe	rundll32.exe
PID 3440 wrote to memory of 680	3440	rundll32.exe	rundll32.exe
PID 3440 wrote to memory of 680	3440	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UpdatedFiles\NewInvoice.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3440

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UpdatedFiles\NewInvoice.dll,#1
2⤵
PID:680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 680 -s 612
3⤵
- Program crash
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 680 -ip 680
1⤵
PID:4532