15308e0f367c86ff398e7c1e2f5057dfdfd046f085a0e11da9e37bf46c98dec0

Resubmissions

09-01-2023 11:01

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
09-01-2023 11:01

Target

YouContract/InvoiceUpdate.dll
Size

516KB
MD5

47de9b443272713b0293996513a95568
SHA1

98ac88a84abe907cb13f3d6784b926e11a0b1fff
SHA256

5764291e780539853bb430a43102eac55387c0b46e49d22f1d8bb894ca1dac89
SHA512

a0589281b70ae7047c77b1178fa1d73bc119d9543d7a27323d371d62a336198aee8fe9a588f14df868b271ee059293a4e9de6da4ac481904c18a36e880fdfaa9
SSDEEP

6144:wiIqnct7uycRpLrFPQleGc2BpeQvfTiD3MJIyFX+OwjzK9y9KOc6rXPMATcBu:wihnctArBgRprvbiIIAuz19nTMAgc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1720 wrote to memory of 2012	1720	rundll32.exe	rundll32.exe
PID 1720 wrote to memory of 2012	1720	rundll32.exe	rundll32.exe
PID 1720 wrote to memory of 2012	1720	rundll32.exe	rundll32.exe
PID 1720 wrote to memory of 2012	1720	rundll32.exe	rundll32.exe
PID 1720 wrote to memory of 2012	1720	rundll32.exe	rundll32.exe
PID 1720 wrote to memory of 2012	1720	rundll32.exe	rundll32.exe
PID 1720 wrote to memory of 2012	1720	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\YouContract\InvoiceUpdate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\YouContract\InvoiceUpdate.dll,#1
2⤵
PID:2012

memory/2012-54-0x0000000000000000-mapping.dmp

Download
memory/2012-55-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download