3a23bfb7585033cb42847fcbd2652accf014a4f201ee60e30971ea13c52bba31

Analysis

max time kernel
8s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 08:03

Target

2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe
Size

279KB
MD5

ca7cde7b264002875917f8d9dffce121
SHA1

397412eba92b5c02de4a443c180ea82aa536c349
SHA256

52fd417b6f1a4a369a03bf5c449f380b3415d37fcc8e99d03c72bf0d07831986
SHA512

aaf023c3443e48d6717d9f0872c14e5863c63fe16cee9360e7dfaaefd10dc6d4444e479b410f6b9f58f7bc73165de5da7288f70ca23e4aed6ca161c3ba792598
SSDEEP

6144:NnosW1EBUJk5RUJIQ6CtCyuP5/M/2goLlUZCXF+z7l:Nmmm6fEO1LxCZ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1728 1588 WerFault.exe 2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe

pid	pid_target	process	target process
1728	1588	WerFault.exe	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe

description	pid	process	target process
PID 1588 wrote to memory of 1728	1588	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	WerFault.exe
PID 1588 wrote to memory of 1728	1588	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	WerFault.exe
PID 1588 wrote to memory of 1728	1588	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	WerFault.exe
PID 1588 wrote to memory of 1728	1588	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe
"C:\Users\Admin\AppData\Local\Temp\2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 176
2⤵
- Program crash
PID:1728

memory/1588-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1728-55-0x0000000000000000-mapping.dmp

Download