837e7a67db612b25bfd0f94d37cdbe8b2dc1a298fe5641f27a233ea6daa73bf0

Resubmissions

19-03-2024 22:30

24-01-2024 00:36

max time kernel
119s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 22:30

Target

Summary-of-Plan-Fee-Changes-and-Investment-Options.exe
Size

300.2MB
MD5

d7bf2353ea8cfa75775f30550b56d582
SHA1

08aa0f6394b4197774ad48e1d8e429c1d1226a37
SHA256

837e7a67db612b25bfd0f94d37cdbe8b2dc1a298fe5641f27a233ea6daa73bf0
SHA512

9c80b91f9f49d862448ad3e4fec1f2e2b473055a4a51ad51672d6227510f0fcecfdfecf3a9985166e3797f9240f29a2ec9896348990755d9bedf07a11050ba10
SSDEEP

49152:gSqNDb4vTNRoETyDeg444444444444444444444444444444444444444444444v:ge

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 3012	2940	Summary-of-Plan-Fee-Changes-and-Investment-Options.exe	28
PID 2940 wrote to memory of 3012	2940	Summary-of-Plan-Fee-Changes-and-Investment-Options.exe	28
PID 2940 wrote to memory of 3012	2940	Summary-of-Plan-Fee-Changes-and-Investment-Options.exe	28

C:\Users\Admin\AppData\Local\Temp\Summary-of-Plan-Fee-Changes-and-Investment-Options.exe
"C:\Users\Admin\AppData\Local\Temp\Summary-of-Plan-Fee-Changes-and-Investment-Options.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2940 -s 532
  2⤵
  PID:3012

memory/2940-0-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/2940-1-0x000000013FA10000-0x0000000140A10000-memory.dmp

Filesize
16.0MB

Download
memory/2940-2-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download