14ff23b3a6a5401b1b306dac89df177a2494323f77de648cf10c882e5c04d451

Analysis

max time kernel
36s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 08:18

Target

2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
Size

279KB
MD5

ca7cde7b264002875917f8d9dffce121
SHA1

397412eba92b5c02de4a443c180ea82aa536c349
SHA256

52fd417b6f1a4a369a03bf5c449f380b3415d37fcc8e99d03c72bf0d07831986
SHA512

aaf023c3443e48d6717d9f0872c14e5863c63fe16cee9360e7dfaaefd10dc6d4444e479b410f6b9f58f7bc73165de5da7288f70ca23e4aed6ca161c3ba792598
SSDEEP

6144:NnosW1EBUJk5RUJIQ6CtCyuP5/M/2goLlUZCXF+z7l:Nmmm6fEO1LxCZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1712	340	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 340 wrote to memory of 1712	340	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	27
PID 340 wrote to memory of 1712	340	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	27
PID 340 wrote to memory of 1712	340	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	27
PID 340 wrote to memory of 1712	340	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	27

C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
"C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 340 -s 176
  2⤵
  - Program crash
  PID:1712

memory/340-54-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download
memory/1712-55-0x0000000000000000-mapping.dmp

Download