0029e9cc616276a2d6605f723d515c326287c063d97c746aee588050a56a531b

Analysis

max time kernel
90s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2022 19:58

Target

GetInvoice/DirectContract.dll
Size

552KB
MD5

76b2ae39b536b6c50726bb1a4e409842
SHA1

9d37068cab8de8396478d0d446ca41933a75d47d
SHA256

1bcb3eef5c6f8554249cfb5fddc68024335825a8568816ffc8c9a6e89f27c5d0
SHA512

6458ef209e671a47c059d777cad1db1e619f71f5736a7e8bd6e56018b4015b827187d881e41b5f9bd2d6b570520187bcf17865544afe11701ed10d439cf03786
SSDEEP

12288:H7uM8sVm1kWF/eLJ+QlfW4MwauXWfFyDFfEWmqTqQpa4NLVZC:H+sVmhledMmGdu+ZqHzC

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4992 1236 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4992	1236	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4244 wrote to memory of 1236	4244	rundll32.exe	rundll32.exe
PID 4244 wrote to memory of 1236	4244	rundll32.exe	rundll32.exe
PID 4244 wrote to memory of 1236	4244	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GetInvoice\DirectContract.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4244

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GetInvoice\DirectContract.dll,#1
2⤵
PID:1236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 604
3⤵
- Program crash
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1236 -ip 1236
1⤵
PID:4648