ccd3d1ec6d5b5723225b7d0c6488de099b2b22c5b70bc1c521c148160f5997cc

Analysis

max time kernel
240s
max time network
278s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22/10/2023, 07:41

Target
Quote Request.exe
Size 593KB
Sample231022-jh57csec2w
SHA256 ccd3d1ec6d5b5723225b7d0c6488de099b2b22c5b70bc1c521c148160f5997cc
MD5 010c9d1a915b7550181014f34ed12a80
SHA1 687bb9aa1047c3d19e76570e130d5efe76a9a336
SHA512 2f15d87d03e3e2c6d007ae4668c294094eb6e570532eb596fa8d5955d857198c2ee7789ff72eb4928ace201cc6f4e5b183e15d076235948df27647af3732c5ae
SSDEEP 12288:2OW1vjJGGna1q5IscdEjcdja5VySGJE6awd6jQH171BFM2AYOMgKqhxgyVMwl1:2OW1LJ1na1Or0E4dj4+Ei/BFMlRMgt4M
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2572	2964	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2572	2964	Quote Request.exe	28
PID 2964 wrote to memory of 2572	2964	Quote Request.exe	28
PID 2964 wrote to memory of 2572	2964	Quote Request.exe	28
PID 2964 wrote to memory of 2572	2964	Quote Request.exe	28

C:\Users\Admin\AppData\Local\Temp\Quote Request.exe
"C:\Users\Admin\AppData\Local\Temp\Quote Request.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 668
  2⤵
  - Program crash
  PID:2572

memory/2964-1-0x0000000074310000-0x00000000749FE000-memory.dmp

Download

memory/2964-0-0x00000000002F0000-0x000000000038A000-memory.dmp

Download

memory/2964-2-0x0000000004920000-0x0000000004960000-memory.dmp

Download

memory/2964-3-0x00000000002E0000-0x00000000002F2000-memory.dmp

Download

memory/2964-4-0x0000000074310000-0x00000000749FE000-memory.dmp

Download

memory/2964-5-0x0000000004920000-0x0000000004960000-memory.dmp

Download

memory/2964-6-0x00000000003A0000-0x00000000003B0000-memory.dmp

Download