acb861e1ed0bb973b5e7799a624a188768ee1afe9ef11ef9c05a2ab261bc7deb

Analysis

max time kernel
91s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2023 08:16

Target

CancelledInvoice/YouContract.dll
Size

552KB
MD5

7c703c577032ecdeb85b0cb926d14447
SHA1

cf446b09cad11632b0871a1986f2fa76b5f8d36d
SHA256

053ddd240fee27c268c0c17c7d851a7b55fe6987b0962170d1c1b5e84fc24d68
SHA512

6b96700a896f65c58da045a846b8bdcdf84b786b7dc90721e5189b2da1e75966c25774dbc3fb52dad8ace6c1439bd2c63363ee07ac331f08b7966ca8c6b326ef
SSDEEP

12288:H7uM8sVm1kWF/eLJ+QlfW4MwauXWfFyDFfEWmqTqQpa4NLVZC:H+sVmhledMmGdu+ZqHzC

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2900 2360 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2900	2360	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2220 wrote to memory of 2360	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2360	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2360	2220	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CancelledInvoice\YouContract.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CancelledInvoice\YouContract.dll,#1
2⤵
PID:2360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 604
3⤵
- Program crash
PID:2900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2360 -ip 2360
1⤵
PID:3068