5f77820a216c11967c35f8abcd89531b94009df06fd7cd6494675750f2188696

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-05-2024 05:08

Target

Frachtbrief.exe
Size

950KB
MD5

bbe19513f246c2ce20a942aac0c6734c
SHA1

ea1f006b677588e451288af724462302ce26fe10
SHA256

c64350d1fb8dfa16c69882ed5ae2d5cb5dd9301e4db24817fdec93df2b20b120
SHA512

256dd2ca23f9fc65b5422aa388d30b7f9956b74413b717cbc3d42449a8ebaeb82498fada6e35ffd30b79dd638394cd10a5e5aee085d77c07329bbea015065967
SSDEEP

24576:UOBHtIiz6aFpMdGjyupSMyhICpRj/LPO6GjAlckeo:FtI5oeup/3yB/LP7qAlcke

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2184	1964	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2184	1964	Frachtbrief.exe	28
PID 1964 wrote to memory of 2184	1964	Frachtbrief.exe	28
PID 1964 wrote to memory of 2184	1964	Frachtbrief.exe	28
PID 1964 wrote to memory of 2184	1964	Frachtbrief.exe	28

C:\Users\Admin\AppData\Local\Temp\Frachtbrief.exe
"C:\Users\Admin\AppData\Local\Temp\Frachtbrief.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 600
  2⤵
  - Program crash
  PID:2184

memory/1964-0-0x00000000745FE000-0x00000000745FF000-memory.dmp

Filesize
4KB

Download
memory/1964-1-0x0000000001080000-0x0000000001174000-memory.dmp

Filesize
976KB

Download
memory/1964-2-0x00000000745F0000-0x0000000074CDE000-memory.dmp

Filesize
6.9MB

Download
memory/1964-3-0x00000000745FE000-0x00000000745FF000-memory.dmp

Filesize
4KB

Download
memory/1964-4-0x00000000745F0000-0x0000000074CDE000-memory.dmp

Filesize
6.9MB

Download