264287c5f1b361ec812fe7ecb1976f7dd6ef60bff2e40000f6258f190d481ccd

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21/02/2023, 21:53

Target
Shipment Invoice.exe
Size 499KB
Sample230221-1rl9aagg37
SHA256 264287c5f1b361ec812fe7ecb1976f7dd6ef60bff2e40000f6258f190d481ccd
MD5 fd7cc6115c89bc07d22abfc54324db05
SHA1 60d582c4695d2d5003cb95e8b865d1486d89b81f
SHA512 ae6b924e264c75a8f7827c802e57b8a6e6c16fac4e8a65068f740ddd46ed7d1455163bace4f1025d377752da03a85e35a05c22a18de0b6bebf45a2970322cefa
SSDEEP 12288:YodZoI3oeBYx85qg1I8Clgp2KqakTyT+QOGbJfNuK0JD3j:FdtYeB6magIPar+QpJVuKSD3j
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	1268	WerFault.exe	25

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 2028	1268	Shipment Invoice.exe	26
PID 1268 wrote to memory of 2028	1268	Shipment Invoice.exe	26
PID 1268 wrote to memory of 2028	1268	Shipment Invoice.exe	26

C:\Users\Admin\AppData\Local\Temp\Shipment Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Shipment Invoice.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1268 -s 684
  2⤵
  - Program crash
  PID:2028

memory/1268-54-0x00000000001A0000-0x0000000000222000-memory.dmp

Download

memory/1268-55-0x000000001B040000-0x000000001B0C0000-memory.dmp

Download