80432177df79f70a80d85576936ae972ba85c1c7d949ceb263a97e54b4b48c1c

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
01-12-2023 06:49

Target

Proforma Invoice No.42037 _PDF.exe
Size

696KB
MD5

ac45ab0fd984c1fbe4caa1624409d419
SHA1

08cef5d01f69628db280ff96fae998165cf1ba54
SHA256

80432177df79f70a80d85576936ae972ba85c1c7d949ceb263a97e54b4b48c1c
SHA512

c02b806c9609b9c73cd79ceadff44086bc354e524077a57d13132956768e45403a2c47e2f0c0f98806fbf6ec5c393edb545b59f2b1bdba77843ab357873f7b65
SSDEEP

12288:OA31vjJGGna1bOLcOEYUWQczCjAz9C1rOe/KGZmw+XJsK3usIf8sWHJU6:OA31LJ1na1pXtakjwe/K6x+59If8sWHJ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2684 2252 WerFault.exe Proforma Invoice No.42037 _PDF.exe

pid	pid_target	process	target process
2684	2252	WerFault.exe	Proforma Invoice No.42037 _PDF.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Proforma Invoice No.42037 _PDF.exe

description	pid	process	target process
PID 2252 wrote to memory of 2684	2252	Proforma Invoice No.42037 _PDF.exe	WerFault.exe
PID 2252 wrote to memory of 2684	2252	Proforma Invoice No.42037 _PDF.exe	WerFault.exe
PID 2252 wrote to memory of 2684	2252	Proforma Invoice No.42037 _PDF.exe	WerFault.exe
PID 2252 wrote to memory of 2684	2252	Proforma Invoice No.42037 _PDF.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Proforma Invoice No.42037 _PDF.exe
"C:\Users\Admin\AppData\Local\Temp\Proforma Invoice No.42037 _PDF.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 664
2⤵
- Program crash
PID:2684

memory/2252-0-0x0000000000CB0000-0x0000000000D64000-memory.dmp

Filesize
720KB

Download
memory/2252-1-0x0000000074260000-0x000000007494E000-memory.dmp

Filesize
6.9MB

Download
memory/2252-2-0x00000000048C0000-0x0000000004900000-memory.dmp

Filesize
256KB

Download
memory/2252-3-0x0000000000810000-0x0000000000822000-memory.dmp

Filesize
72KB

Download
memory/2252-4-0x0000000074260000-0x000000007494E000-memory.dmp

Filesize
6.9MB

Download
memory/2252-5-0x00000000048C0000-0x0000000004900000-memory.dmp

Filesize
256KB

Download
memory/2252-6-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download