224d047b62d6fd457253d627ac088bd3076b2ffe137df3ffaf918e73bb4f684f

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19/07/2023, 07:28

Target

#TN#1053958936#306E#TWKN.PDF.scr
Size

676KB
MD5

384c43c53e26b04077e7ffe810574718
SHA1

9e82f9731837dfe4bd38f73da095ec27c5c4b9ff
SHA256

224d047b62d6fd457253d627ac088bd3076b2ffe137df3ffaf918e73bb4f684f
SHA512

bcfb5a4b38aa0e21a838c4a238359ec8050db9d05b0ece7bdfc482e70bec47d08e336a36f768f3b70153c7b610a18692e17fe8c3d04904e0547413c11374061a
SSDEEP

12288:uPYPfY7iHnWpD3Y/MtlxcV2RtalYkvLPJsBYDu3tcmowXlLWD:uPYPgrpLYEtlntmLvzJsBCOtcyLg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1752	1008	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 1752	1008	#TN#1053958936#306E#TWKN.PDF.scr	30
PID 1008 wrote to memory of 1752	1008	#TN#1053958936#306E#TWKN.PDF.scr	30
PID 1008 wrote to memory of 1752	1008	#TN#1053958936#306E#TWKN.PDF.scr	30
PID 1008 wrote to memory of 1752	1008	#TN#1053958936#306E#TWKN.PDF.scr	30

C:\Users\Admin\AppData\Local\Temp\#TN#1053958936#306E#TWKN.PDF.scr
"C:\Users\Admin\AppData\Local\Temp\#TN#1053958936#306E#TWKN.PDF.scr" /S
1⤵
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 672
  2⤵
  - Program crash
  PID:1752

memory/1008-54-0x0000000001380000-0x0000000001430000-memory.dmp

Filesize
704KB

Download
memory/1008-55-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/1008-56-0x0000000000C20000-0x0000000000C60000-memory.dmp

Filesize
256KB

Download
memory/1008-57-0x00000000002C0000-0x00000000002CE000-memory.dmp

Filesize
56KB

Download
memory/1008-58-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/1008-59-0x0000000000C20000-0x0000000000C60000-memory.dmp

Filesize
256KB

Download
memory/1008-60-0x00000000005F0000-0x00000000005FA000-memory.dmp

Filesize
40KB

Download