69aeb91a60a2c2cc6e6ec7dfb4feaf97690529d3345b615cfb884b07d9d4b4e5

Analysis

max time kernel
1s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08/06/2023, 09:50

Target

OperativesDataSign.exe
Size

3.1MB
MD5

48a4f3f261acf5dbe3f39a54c2d02173
SHA1

cc913158e6bbbeee2e312fd27300088527b0800c
SHA256

69aeb91a60a2c2cc6e6ec7dfb4feaf97690529d3345b615cfb884b07d9d4b4e5
SHA512

60ced22d0f498760331c46410b48d9a20cddd678d97c60863808bb2538b62cace882c80676471bd654ae189bda578d1d9e2c648758d6bf905f19fd697bd83da2
SSDEEP

24576:goT/l9X4DGM/Z2xL5XXdu9Z/G/3Yz/AaSsPvRCZL/PZwGoKhQwvwD828WFxL5XX0:R9X4xZyH8GQrGD7+mfDWbH8G

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1324	1064	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1324	1064	OperativesDataSign.exe	28
PID 1064 wrote to memory of 1324	1064	OperativesDataSign.exe	28
PID 1064 wrote to memory of 1324	1064	OperativesDataSign.exe	28

C:\Users\Admin\AppData\Local\Temp\OperativesDataSign.exe
"C:\Users\Admin\AppData\Local\Temp\OperativesDataSign.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1064 -s 532
  2⤵
  - Program crash
  PID:1324

memory/1064-54-0x000000013FF50000-0x0000000140262000-memory.dmp

Filesize
3.1MB

Download