15308e0f367c86ff398e7c1e2f5057dfdfd046f085a0e11da9e37bf46c98dec0

Resubmissions

09-01-2023 11:01

max time kernel
134s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2023 11:01

Target

YouContract/InvoiceUpdate.dll
Size

516KB
MD5

47de9b443272713b0293996513a95568
SHA1

98ac88a84abe907cb13f3d6784b926e11a0b1fff
SHA256

5764291e780539853bb430a43102eac55387c0b46e49d22f1d8bb894ca1dac89
SHA512

a0589281b70ae7047c77b1178fa1d73bc119d9543d7a27323d371d62a336198aee8fe9a588f14df868b271ee059293a4e9de6da4ac481904c18a36e880fdfaa9
SSDEEP

6144:wiIqnct7uycRpLrFPQleGc2BpeQvfTiD3MJIyFX+OwjzK9y9KOc6rXPMATcBu:wihnctArBgRprvbiIIAuz19nTMAgc

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2036 3884 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2036	3884	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1224 wrote to memory of 3884	1224	rundll32.exe	rundll32.exe
PID 1224 wrote to memory of 3884	1224	rundll32.exe	rundll32.exe
PID 1224 wrote to memory of 3884	1224	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\YouContract\InvoiceUpdate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1224

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\YouContract\InvoiceUpdate.dll,#1
2⤵
PID:3884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 600
3⤵
- Program crash
PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3884 -ip 3884
1⤵
PID:1756