9a289cec6288093e7065db5d81133d883205ef554d0f8744f7b3d3307bb0c228

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/10/2022, 14:27

Target
DOCUMENT.exe
Size 251KB
Sample221007-rseq6achdn
SHA256 9a289cec6288093e7065db5d81133d883205ef554d0f8744f7b3d3307bb0c228
MD5 3d5665018e35ac31211f08362ba8191c
SHA1 4b2c6a0c11b3b4cffc8fe3ffd9e581b37eb611d4
SHA512 b91395814c727928db789e11e4ef038968dbb211b9c7d427c56a41ca8df47a810554276a4911c2d98a51d269e4d441c0166f4d1be5ee9a2ea875ff8e168aaad3
SSDEEP 6144:BEPvM0OAxagD8NLYJRhqhL7C/Ze0dltczhOBdkE7j:UvMbAx98VYSCZDcoX7j
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1232	1652	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1232	1652	DOCUMENT.exe	28
PID 1652 wrote to memory of 1232	1652	DOCUMENT.exe	28
PID 1652 wrote to memory of 1232	1652	DOCUMENT.exe	28

C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe
"C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1652 -s 544
  2⤵
  - Program crash
  PID:1232

memory/1652-54-0x0000000000330000-0x0000000000374000-memory.dmp

Download