0e111fd35d15d2b284e9d94d67aa97af1df6fe73e41e22529f0326c5f811db7c

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 14:22

Target

BoletoDiario.exe
Size

117KB
MD5

b37820404ab0bf417712006e74bf4f7a
SHA1

e9ca485b8940bc583f00ed3e048c18d0b954c54c
SHA256

46478b71ace178a2fe340b93c44cf262d0c7edf41fac9406d2360abce15fb267
SHA512

ff1a45dda2f821cf08c332dce86183ad649f797f75b0bdd1e44ef6c84bb0e42babfb6497cc9f2d8b01d53ac4461a574136a9910140cdafcd64b8c6eb3f5197c7
SSDEEP

1536:RD1TM625P+kj+cClr2FEKqKefB6VjnvWDmkOXLwkQgMRdTtQQU9ZWjaSz4q:IQm+z6eyjv2mkOXLwkeRdbBz4q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	1104	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1696	1104	BoletoDiario.exe	29
PID 1104 wrote to memory of 1696	1104	BoletoDiario.exe	29
PID 1104 wrote to memory of 1696	1104	BoletoDiario.exe	29
PID 1104 wrote to memory of 1696	1104	BoletoDiario.exe	29

C:\Users\Admin\AppData\Local\Temp\BoletoDiario.exe
"C:\Users\Admin\AppData\Local\Temp\BoletoDiario.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 748
  2⤵
  - Program crash
  PID:1696

memory/1104-0-0x00000000742CE000-0x00000000742CF000-memory.dmp

Filesize
4KB

Download
memory/1104-1-0x00000000002A0000-0x00000000002C4000-memory.dmp

Filesize
144KB

Download
memory/1104-2-0x0000000004D80000-0x00000000055AC000-memory.dmp

Filesize
8.2MB

Download
memory/1104-3-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/1104-4-0x0000000005F40000-0x00000000079CE000-memory.dmp

Filesize
26.6MB

Download
memory/1104-5-0x00000000005E0000-0x0000000000612000-memory.dmp

Filesize
200KB

Download
memory/1104-6-0x0000000007B90000-0x0000000007EE0000-memory.dmp

Filesize
3.3MB

Download
memory/1104-7-0x0000000007EE0000-0x000000000850C000-memory.dmp

Filesize
6.2MB

Download
memory/1104-8-0x00000000742CE000-0x00000000742CF000-memory.dmp

Filesize
4KB

Download
memory/1104-9-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download