79c6fb90545837f8ac314eaf24336831bf482b9dcc089d7002b990161002458a

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
12/11/2023, 08:32

Target

INV_CNGMT_AT_12_11_2023.exe
Size

750KB
MD5

1b2d19fad1f79cb3e5a4dad054bbb839
SHA1

914494dd5f6bc9b0ccfb34a7812d54ee60560409
SHA256

79c6fb90545837f8ac314eaf24336831bf482b9dcc089d7002b990161002458a
SHA512

4db81f115c358257cdf5388c8d5bdf7ff30328e9b6b6741134b9e95088d8dbe3d8aad5f6485f4a1749cef56ce080fd1512e78b67c0403c1bfdce1ed05bbe1eb6
SSDEEP

12288:xCZtj1XrtQg3zwGKfez9zrLWJKoV8hgqcIpCuRNo1re3FxqbqNKRgcmBfIMDke6P:xW7XrWIwGWoLWgfeubVGROfIMwx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2680	2888	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2680	2888	INV_CNGMT_AT_12_11_2023.exe	28
PID 2888 wrote to memory of 2680	2888	INV_CNGMT_AT_12_11_2023.exe	28
PID 2888 wrote to memory of 2680	2888	INV_CNGMT_AT_12_11_2023.exe	28
PID 2888 wrote to memory of 2680	2888	INV_CNGMT_AT_12_11_2023.exe	28

C:\Users\Admin\AppData\Local\Temp\INV_CNGMT_AT_12_11_2023.exe
"C:\Users\Admin\AppData\Local\Temp\INV_CNGMT_AT_12_11_2023.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 564
  2⤵
  - Program crash
  PID:2680

memory/2888-0-0x0000000000A90000-0x0000000000B50000-memory.dmp

Filesize
768KB

Download
memory/2888-1-0x0000000074EA0000-0x000000007558E000-memory.dmp

Filesize
6.9MB

Download
memory/2888-2-0x0000000004850000-0x0000000004890000-memory.dmp

Filesize
256KB

Download
memory/2888-3-0x0000000074EA0000-0x000000007558E000-memory.dmp

Filesize
6.9MB

Download
memory/2888-4-0x0000000004850000-0x0000000004890000-memory.dmp

Filesize
256KB

Download