6ee78b18ddb57ebb710f371d9c01b743fc7fb080527360a56d9981c56cdffffb

Analysis

max time kernel
44s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 20:33

Target

ORPALIS PaperScan Professional Edition 4.0.9 [PeskTop.com]/Crack/PaperScan.exe
Size

9.4MB
MD5

f434756b39750e43ff96b755b3f849dc
SHA1

65f46285af19eae27d7459fb5a4ac16230a8caa4
SHA256

bd22511826b242bb41fe9b4ce8aacde2c2bb99443335b341c8ab2bb363d7675b
SHA512

22c5ebf5c4d975cd0cbc8247d29afda480503f184a48adebc98b01ffdb7a56333ff48f90ea952a55fe77e44a5193fa2b3ca91188d65de2d3f3ae2ed7a62fb21d
SSDEEP

98304:a4oTwMMM+MMMQMMM+MMMxMMM+MMMLMMM+MMMgMMM+MMMRMMM+MMMHMMM+MMMcMMZ:a/uYs0+mfeISrU2KxU1b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2904 2384 WerFault.exe PaperScan.exe

pid	pid_target	process	target process
2904	2384	WerFault.exe	PaperScan.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

PaperScan.exe

description	pid	process	target process
PID 2384 wrote to memory of 2904	2384	PaperScan.exe	WerFault.exe
PID 2384 wrote to memory of 2904	2384	PaperScan.exe	WerFault.exe
PID 2384 wrote to memory of 2904	2384	PaperScan.exe	WerFault.exe
PID 2384 wrote to memory of 2904	2384	PaperScan.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ORPALIS PaperScan Professional Edition 4.0.9 [PeskTop.com]\Crack\PaperScan.exe
"C:\Users\Admin\AppData\Local\Temp\ORPALIS PaperScan Professional Edition 4.0.9 [PeskTop.com]\Crack\PaperScan.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 552
  2⤵
  - Program crash
  PID:2904

memory/2384-0-0x0000000073FC0000-0x00000000746AE000-memory.dmp

Filesize
6.9MB

Download
memory/2384-1-0x0000000000B90000-0x00000000014FE000-memory.dmp

Filesize
9.4MB

Download
memory/2384-2-0x0000000073FC0000-0x00000000746AE000-memory.dmp

Filesize
6.9MB

Download