ecd24005f85411e22ced38e6c7c8cc23395295a3ccf607299dc82058a5125e07

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19/07/2023, 12:46

Target

RFQ 94844.exe
Size

588KB
MD5

989422f879750f025f62576fc6bb3839
SHA1

a7d2a8943b026fd82771b1ea982c1374b8075880
SHA256

ecd24005f85411e22ced38e6c7c8cc23395295a3ccf607299dc82058a5125e07
SHA512

020570a38d129e4bd55d55cf0fda9871a193a7aeba0d84eefa316ecb7845bc613dbbe56971facdf92f46c5a71b0b19a12a30ddc535072facf3c23397dd65cb6a
SSDEEP

12288:q1PYPfY7bPiZMTjyC4CHOsH+yB7Li/EWxW0HBC4ZWtkwbYrp:iPYPgnPiuHLFH+yBfiMGHBz0uuY1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2864	2236	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2864	2236	RFQ 94844.exe	30
PID 2236 wrote to memory of 2864	2236	RFQ 94844.exe	30
PID 2236 wrote to memory of 2864	2236	RFQ 94844.exe	30
PID 2236 wrote to memory of 2864	2236	RFQ 94844.exe	30

C:\Users\Admin\AppData\Local\Temp\RFQ 94844.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ 94844.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 680
  2⤵
  - Program crash
  PID:2864

memory/2236-54-0x0000000000B70000-0x0000000000C0A000-memory.dmp

Filesize
616KB

Download
memory/2236-55-0x0000000073E80000-0x000000007456E000-memory.dmp

Filesize
6.9MB

Download
memory/2236-56-0x0000000004E00000-0x0000000004E40000-memory.dmp

Filesize
256KB

Download
memory/2236-57-0x00000000005B0000-0x00000000005BE000-memory.dmp

Filesize
56KB

Download
memory/2236-58-0x0000000073E80000-0x000000007456E000-memory.dmp

Filesize
6.9MB

Download
memory/2236-59-0x0000000004E00000-0x0000000004E40000-memory.dmp

Filesize
256KB

Download
memory/2236-60-0x0000000000820000-0x000000000082A000-memory.dmp

Filesize
40KB

Download