558c7f1385b562613a80e0098f8c3f13fcbfd3898602803d72823dd5583ac6a7

Resubmissions

11/05/2024, 00:30

11/05/2024, 00:30

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 00:30

Target

SpantaW.exe
Size

429KB
MD5

38f3d1391d1de10e6284949118d0374d
SHA1

dfa9354cf023932dae7919ac88748b46b60f05ff
SHA256

558c7f1385b562613a80e0098f8c3f13fcbfd3898602803d72823dd5583ac6a7
SHA512

5c086c155734b90941d65c630cdb2bcc68319bae25ebd62195da47e97d686e13cec8f12aca1277dda94094635020db069e434e556a63d129950f1f360e99e0c3
SSDEEP

12288:Qbh5Yy2xs3E9ihq4jbh5Yy2xs3E9ihq4:Qb3MT9i84jb3MT9i84

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2484	2208	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2484	2208	SpantaW.exe	28
PID 2208 wrote to memory of 2484	2208	SpantaW.exe	28
PID 2208 wrote to memory of 2484	2208	SpantaW.exe	28
PID 2208 wrote to memory of 2484	2208	SpantaW.exe	28

C:\Users\Admin\AppData\Local\Temp\SpantaW.exe
"C:\Users\Admin\AppData\Local\Temp\SpantaW.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 624
  2⤵
  - Program crash
  PID:2484

memory/2208-0-0x0000000074A1E000-0x0000000074A1F000-memory.dmp

Filesize
4KB

Download
memory/2208-1-0x0000000000A80000-0x0000000000AF2000-memory.dmp

Filesize
456KB

Download
memory/2208-2-0x0000000074A10000-0x00000000750FE000-memory.dmp

Filesize
6.9MB

Download
memory/2208-3-0x0000000074A1E000-0x0000000074A1F000-memory.dmp

Filesize
4KB

Download
memory/2208-4-0x0000000074A10000-0x00000000750FE000-memory.dmp

Filesize
6.9MB

Download