f4153f8494d015bbe6740d237a848dc9898726b4812f015d47c80eac08fe5e12

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 10:15

Target

Document for shipping.exe
Size

714KB
MD5

e8e193c463155c347c1a4cd828e5947f
SHA1

2c3ddd91660d4590ed48aad854d3568dea951af3
SHA256

f4153f8494d015bbe6740d237a848dc9898726b4812f015d47c80eac08fe5e12
SHA512

e4c81e3d3c6c8ff21ec95c2766b1aadd3a0ab64b8837a176271f79a7860e935caaa030f7f9504f9aca0d7b6959c4ad9f379d40ce1cd6475c392c5ade838c47aa
SSDEEP

12288:mAtH617FRqHXH2sfD+CXVTfnAnR0b7GPdfe4pFjKYGK/McCMGAJ76KLa0Tu3LU4l:cR0bfwZPGK/ZCMGAJ76KLa0S3LUQV6YL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1952	1456	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1952	1456	Document for shipping.exe	28
PID 1456 wrote to memory of 1952	1456	Document for shipping.exe	28
PID 1456 wrote to memory of 1952	1456	Document for shipping.exe	28
PID 1456 wrote to memory of 1952	1456	Document for shipping.exe	28

C:\Users\Admin\AppData\Local\Temp\Document for shipping.exe
"C:\Users\Admin\AppData\Local\Temp\Document for shipping.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 660
  2⤵
  - Program crash
  PID:1952

memory/1456-0-0x0000000000390000-0x0000000000448000-memory.dmp

Filesize
736KB

Download
memory/1456-1-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/1456-2-0x0000000004990000-0x00000000049D0000-memory.dmp

Filesize
256KB

Download
memory/1456-3-0x00000000048A0000-0x000000000494C000-memory.dmp

Filesize
688KB

Download
memory/1456-4-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download