d6325d4aa8bc6a935f0d1b136a1e791c554cb78ffc23823e9601031e6a677c3d

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19/07/2023, 09:38

Target
RFx_ExxonMobil-Documents.exe
Size 662KB
Sample230719-ll2pfsbd65
SHA256 d6325d4aa8bc6a935f0d1b136a1e791c554cb78ffc23823e9601031e6a677c3d
MD5 1782b7236df84ce58befb6e29c2ddecb
SHA1 fe583fc137f63be313d85692efad3675ca873f1b
SHA512 c65775e5e71704f2fb03f4a4032a3f6aa305dcd31627ca9868c698e2298bd7263f383f5a3c25cda78cd174fd26d4be7e36aa3dd8c4a0cbb8f1747428492b347b
SSDEEP 12288:fqPYPfY7JLlD7MtOwndshtpNt/azlbud4B3v3tjWh/N/v2H:SPYPgbD7MtTdsPpj/sbud8t6zv
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1084	952	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 1084	952	RFx_ExxonMobil-Documents.exe	30
PID 952 wrote to memory of 1084	952	RFx_ExxonMobil-Documents.exe	30
PID 952 wrote to memory of 1084	952	RFx_ExxonMobil-Documents.exe	30
PID 952 wrote to memory of 1084	952	RFx_ExxonMobil-Documents.exe	30

C:\Users\Admin\AppData\Local\Temp\RFx_ExxonMobil-Documents.exe
"C:\Users\Admin\AppData\Local\Temp\RFx_ExxonMobil-Documents.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 680
  2⤵
  - Program crash
  PID:1084

memory/952-54-0x0000000074AF0000-0x00000000751DE000-memory.dmp

Download

memory/952-55-0x00000000013B0000-0x000000000145C000-memory.dmp

Download

memory/952-56-0x0000000001300000-0x0000000001340000-memory.dmp

Download

memory/952-57-0x00000000008A0000-0x00000000008AE000-memory.dmp

Download

memory/952-58-0x0000000074AF0000-0x00000000751DE000-memory.dmp

Download

memory/952-59-0x0000000001300000-0x0000000001340000-memory.dmp

Download

memory/952-60-0x0000000000A20000-0x0000000000A2A000-memory.dmp

Download