acb861e1ed0bb973b5e7799a624a188768ee1afe9ef11ef9c05a2ab261bc7deb

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-01-2023 08:16

Target

CancelledInvoice/YouContract.dll
Size

552KB
MD5

7c703c577032ecdeb85b0cb926d14447
SHA1

cf446b09cad11632b0871a1986f2fa76b5f8d36d
SHA256

053ddd240fee27c268c0c17c7d851a7b55fe6987b0962170d1c1b5e84fc24d68
SHA512

6b96700a896f65c58da045a846b8bdcdf84b786b7dc90721e5189b2da1e75966c25774dbc3fb52dad8ace6c1439bd2c63363ee07ac331f08b7966ca8c6b326ef
SSDEEP

12288:H7uM8sVm1kWF/eLJ+QlfW4MwauXWfFyDFfEWmqTqQpa4NLVZC:H+sVmhledMmGdu+ZqHzC

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1724 1596 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1724	1596	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 788 wrote to memory of 1596	788	rundll32.exe	rundll32.exe
PID 788 wrote to memory of 1596	788	rundll32.exe	rundll32.exe
PID 788 wrote to memory of 1596	788	rundll32.exe	rundll32.exe
PID 788 wrote to memory of 1596	788	rundll32.exe	rundll32.exe
PID 788 wrote to memory of 1596	788	rundll32.exe	rundll32.exe
PID 788 wrote to memory of 1596	788	rundll32.exe	rundll32.exe
PID 788 wrote to memory of 1596	788	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 1724	1596	rundll32.exe	WerFault.exe
PID 1596 wrote to memory of 1724	1596	rundll32.exe	WerFault.exe
PID 1596 wrote to memory of 1724	1596	rundll32.exe	WerFault.exe
PID 1596 wrote to memory of 1724	1596	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CancelledInvoice\YouContract.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:788

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CancelledInvoice\YouContract.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 232
3⤵
- Program crash
PID:1724

memory/1596-54-0x0000000000000000-mapping.dmp

Download
memory/1596-55-0x00000000763D1000-0x00000000763D3000-memory.dmp

Filesize
8KB

Download
memory/1724-56-0x0000000000000000-mapping.dmp

Download