86ad5c7ca58c6f796cfb64a977f1e31ab1e318dc4efbb505b3ac8b5e1d90775e

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24/04/2023, 08:00

Target

Payment Copy______________________________________________pdf.exe
Size

600KB
MD5

4c913c3ad1bdcd3b73c1a00f420333a4
SHA1

6df149f36a3c18447aba2525ea23641794c0be6d
SHA256

86ad5c7ca58c6f796cfb64a977f1e31ab1e318dc4efbb505b3ac8b5e1d90775e
SHA512

aae1fc6272c05234ba34c93716cb2d8d32ef5ad7f9cefa0e73c30a90421373869d152cab1f654db4ff1fe886113aa57b708c559ecc769a404ec654be53ceb440
SSDEEP

12288:6VTmclFiW2KuyNgi8gmDbnRnmwOAw8W9MW0edSfR:6V39EgmDbtVOaW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1624	1444	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1624	1444	Payment Copy______________________________________________pdf.exe	27
PID 1444 wrote to memory of 1624	1444	Payment Copy______________________________________________pdf.exe	27
PID 1444 wrote to memory of 1624	1444	Payment Copy______________________________________________pdf.exe	27
PID 1444 wrote to memory of 1624	1444	Payment Copy______________________________________________pdf.exe	27

C:\Users\Admin\AppData\Local\Temp\Payment Copy______________________________________________pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Copy______________________________________________pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 688
  2⤵
  - Program crash
  PID:1624

memory/1444-54-0x0000000000A40000-0x0000000000ADC000-memory.dmp

Filesize
624KB

Download
memory/1444-55-0x0000000004E00000-0x0000000004E40000-memory.dmp

Filesize
256KB

Download
memory/1444-56-0x0000000004E00000-0x0000000004E40000-memory.dmp

Filesize
256KB

Download