8c29dcbfb5e613983b4f84112d18d69f99c5c7d2c7e76a9b473327412fc74af8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 21:52

Target

BTC PAYMENTSCOPY_____________________________.jpg.exe
Size

743KB
MD5

d5d26738ed73d191556fc5640b43ed39
SHA1

eaec7a86cbe18f9eb5099ca390e43562701f6d29
SHA256

d254826085eaada20b9ab3803fdf88d2326ffcb2e90b36d3fbb129fce1cfed5a
SHA512

475c358c8353daac6efe9212bc649ce22197d38f32e6d63543896f77d420ca50717468e32b92dd975d685ef193624ee96bcac958da6265658748ed483f454529
SSDEEP

12288:I1Wl8T5+M63xjmevfUu+2EYhsJZ2uEYpplNw:IA24dx0Yrmps

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
408	1300	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1076	1300	BTC PAYMENTSCOPY_____________________________.jpg.exe	84
PID 1300 wrote to memory of 1076	1300	BTC PAYMENTSCOPY_____________________________.jpg.exe	84
PID 1300 wrote to memory of 1076	1300	BTC PAYMENTSCOPY_____________________________.jpg.exe	84

C:\Users\Admin\AppData\Local\Temp\BTC PAYMENTSCOPY_____________________________.jpg.exe
"C:\Users\Admin\AppData\Local\Temp\BTC PAYMENTSCOPY_____________________________.jpg.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Users\Admin\AppData\Local\Temp\BTC PAYMENTSCOPY_____________________________.jpg.exe
  "C:\Users\Admin\AppData\Local\Temp\BTC PAYMENTSCOPY_____________________________.jpg.exe"
  2⤵
  PID:1076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 416
  2⤵
  - Program crash
  PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1300 -ip 1300
1⤵
PID:2268

memory/1300-0-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1300-1-0x0000000000660000-0x0000000000662000-memory.dmp

Filesize
8KB

Download
memory/1300-2-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download