bbea7541f726c2ecb8eebbc87f6f52b50db57a836571ae9b0f1fd91dfb653b48

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26/01/2023, 17:23

Target
MACHINE QUOTATION.exe
Size 32KB
Sample230126-vx44dsee69
SHA256 bbea7541f726c2ecb8eebbc87f6f52b50db57a836571ae9b0f1fd91dfb653b48
MD5 e7973abc77f88ab490e32fd14b7d445a
SHA1 52673459e443f6a57c80a0e52160eebb638eaa61
SHA512 4a2784eefd3b760ae28c47a48ab6c250375c39e6f8a04b0eca421e705eabeaf567e68654f2806efaf1cd5c06ec28468849700668189ace2df1b951a2cda1328e
SSDEEP 768:yM119NYrB3JBZd+y043kAmZbIkr05tIevQ:jkHl0exEIk2vQ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1776	2020	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1776	2020	MACHINE QUOTATION.exe	28
PID 2020 wrote to memory of 1776	2020	MACHINE QUOTATION.exe	28
PID 2020 wrote to memory of 1776	2020	MACHINE QUOTATION.exe	28

C:\Users\Admin\AppData\Local\Temp\MACHINE QUOTATION.exe
"C:\Users\Admin\AppData\Local\Temp\MACHINE QUOTATION.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2020 -s 640
  2⤵
  - Program crash
  PID:1776

memory/2020-54-0x0000000000130000-0x000000000013C000-memory.dmp

Download