0029e9cc616276a2d6605f723d515c326287c063d97c746aee588050a56a531b

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-12-2022 19:58

Target

GetInvoice/DirectContract.dll
Size

552KB
MD5

76b2ae39b536b6c50726bb1a4e409842
SHA1

9d37068cab8de8396478d0d446ca41933a75d47d
SHA256

1bcb3eef5c6f8554249cfb5fddc68024335825a8568816ffc8c9a6e89f27c5d0
SHA512

6458ef209e671a47c059d777cad1db1e619f71f5736a7e8bd6e56018b4015b827187d881e41b5f9bd2d6b570520187bcf17865544afe11701ed10d439cf03786
SSDEEP

12288:H7uM8sVm1kWF/eLJ+QlfW4MwauXWfFyDFfEWmqTqQpa4NLVZC:H+sVmhledMmGdu+ZqHzC

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2008 2040 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2008	2040	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2012 wrote to memory of 2040	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2040	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2040	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2040	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2040	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2040	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2040	2012	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 2008	2040	rundll32.exe	WerFault.exe
PID 2040 wrote to memory of 2008	2040	rundll32.exe	WerFault.exe
PID 2040 wrote to memory of 2008	2040	rundll32.exe	WerFault.exe
PID 2040 wrote to memory of 2008	2040	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GetInvoice\DirectContract.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GetInvoice\DirectContract.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 232
3⤵
- Program crash
PID:2008

memory/2008-56-0x0000000000000000-mapping.dmp

Download
memory/2040-54-0x0000000000000000-mapping.dmp

Download
memory/2040-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download