0422c9546bd72399494b2f89026d1bccb6ce039e76d4df745d11e8d29d298b77

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19/07/2023, 10:41

Target

Oferta OFER30052023 NTV.exe
Size

612KB
MD5

93df36476069ba35847c30ad26d05880
SHA1

2d4b1ec873a68e489128bfe0b345e26d3601bc85
SHA256

0422c9546bd72399494b2f89026d1bccb6ce039e76d4df745d11e8d29d298b77
SHA512

2b5cdbd2ff55b9bc823ca0c3c1de94fb6fa36b01d2fbaa8b9de2cd23f3aa32b7b1fb733dc12467c51f082eb2563be379f96776553a0d545f41f096a974c32071
SSDEEP

12288:WmAY2kcdbL4Efqb7lsHgUtOrRu+Tjp4MT1ociOl1Rx4zxOn/olpbKOa:fN6GEfqKHgUt4vjp4ali2uQKpbb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1476	1152	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 1476	1152	Oferta OFER30052023 NTV.exe	30
PID 1152 wrote to memory of 1476	1152	Oferta OFER30052023 NTV.exe	30
PID 1152 wrote to memory of 1476	1152	Oferta OFER30052023 NTV.exe	30
PID 1152 wrote to memory of 1476	1152	Oferta OFER30052023 NTV.exe	30

C:\Users\Admin\AppData\Local\Temp\Oferta OFER30052023 NTV.exe
"C:\Users\Admin\AppData\Local\Temp\Oferta OFER30052023 NTV.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 664
  2⤵
  - Program crash
  PID:1476

memory/1152-54-0x0000000000ED0000-0x0000000000F6E000-memory.dmp

Filesize
632KB

Download
memory/1152-55-0x0000000074ED0000-0x00000000755BE000-memory.dmp

Filesize
6.9MB

Download
memory/1152-56-0x0000000000580000-0x00000000005C0000-memory.dmp

Filesize
256KB

Download
memory/1152-57-0x0000000000520000-0x000000000052E000-memory.dmp

Filesize
56KB

Download
memory/1152-58-0x0000000074ED0000-0x00000000755BE000-memory.dmp

Filesize
6.9MB

Download
memory/1152-59-0x0000000000580000-0x00000000005C0000-memory.dmp

Filesize
256KB

Download
memory/1152-60-0x0000000000890000-0x000000000089A000-memory.dmp

Filesize
40KB

Download