dea0f4b762f8be8c3f654867cf7832e0ebaeda1c4ebcae17f5841743d3dc217f

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
09-10-2023 17:38

Target

Payment Advice - Advice Ref[A1T9IvYc5tfi].exe
Size

693KB
MD5

0b9ae7caf0018bb0be7c6a97746b853f
SHA1

0a13ecd21b1e58b8b82b285b8648fea52ac8e5de
SHA256

dea0f4b762f8be8c3f654867cf7832e0ebaeda1c4ebcae17f5841743d3dc217f
SHA512

0a7c01b47cac051e719623e9c58640f498387761d602147fac7c22b0da9c2a2c973b2dd4e0547078d8ebd834beef39982efab8fb0f64500bed42e555e6b17ad0
SSDEEP

12288:X22iN1BdcibN88WNjUzVD+be6gB+GCY91kmcCGDWp6L5/z7pbGnBI:X21nMibe8WNYzQSB++LiWAV/z1bK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2716	1712	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2716	1712	Payment Advice - Advice Ref[A1T9IvYc5tfi].exe	28
PID 1712 wrote to memory of 2716	1712	Payment Advice - Advice Ref[A1T9IvYc5tfi].exe	28
PID 1712 wrote to memory of 2716	1712	Payment Advice - Advice Ref[A1T9IvYc5tfi].exe	28
PID 1712 wrote to memory of 2716	1712	Payment Advice - Advice Ref[A1T9IvYc5tfi].exe	28

C:\Users\Admin\AppData\Local\Temp\Payment Advice - Advice Ref[A1T9IvYc5tfi].exe
"C:\Users\Admin\AppData\Local\Temp\Payment Advice - Advice Ref[A1T9IvYc5tfi].exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 668
  2⤵
  - Program crash
  PID:2716

memory/1712-0-0x0000000000C30000-0x0000000000CE2000-memory.dmp

Filesize
712KB

Download
memory/1712-1-0x00000000748C0000-0x0000000074FAE000-memory.dmp

Filesize
6.9MB

Download
memory/1712-2-0x0000000004AD0000-0x0000000004B10000-memory.dmp

Filesize
256KB

Download
memory/1712-3-0x0000000000500000-0x0000000000512000-memory.dmp

Filesize
72KB

Download
memory/1712-4-0x00000000748C0000-0x0000000074FAE000-memory.dmp

Filesize
6.9MB

Download
memory/1712-5-0x0000000004AD0000-0x0000000004B10000-memory.dmp

Filesize
256KB

Download
memory/1712-6-0x0000000000570000-0x0000000000580000-memory.dmp

Filesize
64KB

Download