75cdc03e89729226eaefb9259aab9beb4052ddef0280bbf53dcaf8ef9f58d917

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 07:37

Target
Document 151-512024.exe
Size 1.2MB
Sample240508-jfvmvacb55
SHA256 75cdc03e89729226eaefb9259aab9beb4052ddef0280bbf53dcaf8ef9f58d917
MD5 8e009a43143d3afdde5e91b311e4018b
SHA1 332f1f946b6aaadecb3de55c5880d0c61021073f
SHA512 2db471514d4720afed163a576b7c25ce6e45bf46c129ce03ebaa1422e588dcbe16a6107fd34fb7606f6b57e0a5623bbe0ce314584ddd060639a1f6e9345daf24
SSDEEP 24576:YqDEvCTbMWu7rQYlBQcBiT6rprG8a+z74Zcy9xCN6:YTvC/MTQYxsWR7a+vyn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2496	536	WerFault.exe	83

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
536	Document 151-512024.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 4912	536	Document 151-512024.exe	87
PID 536 wrote to memory of 4912	536	Document 151-512024.exe	87
PID 536 wrote to memory of 4912	536	Document 151-512024.exe	87

C:\Users\Admin\AppData\Local\Temp\Document 151-512024.exe
"C:\Users\Admin\AppData\Local\Temp\Document 151-512024.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\Document 151-512024.exe"
  2⤵
  PID:4912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 668
  2⤵
  - Program crash
  PID:2496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 536 -ip 536
1⤵
PID:4716

aut3AE6.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut3AE6.tmp
Size 264KB
SHA256 297d72a6ca8e98558823b71f551ec72508b1adcec64596d41387978fd0ffbd54
MD5 3b92c7c7e1d069d027090bbb8c4c6b3c
SHA1 473ee15a3c0adf847ed03b6861ee051c78e6384c
SHA512 d5c52ddd13ab9b2a47159c46fa8e50e54794977d5740abfa2b6ba0456ad0381750110749804ffc771213189be1cdca1ec89c174e87c72c71af3d1ca4f7300e4e
SSDEEP 3072:P8mwFzK0eX0mcT2dftSU1THjhRqU3S2FabA1im6R2ldqgTtSxEMozosAGyDt/Fk9:UmQK0/mcTkt9LmUTsc1X5SyMTslylFTq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/536-12-0x00000000016D0000-0x00000000016D4000-memory.dmp

Download