85f2d3d2a767b3028a4daf12495c0b1dc02540e29343d630552d7da361018081

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 09:52

Target
Invoice.exe
Size 796KB
Sample240513-lv22kshb3w
SHA256 85f2d3d2a767b3028a4daf12495c0b1dc02540e29343d630552d7da361018081
MD5 29184d4c17997cf75bea7f9dc8b443a5
SHA1 1895eee6dfa23087def403742f3beb7f5ee384c2
SHA512 79bd1781c1e8083af5a9d134293e9a1d6b31df1b8a5a5ab7b68edd1c45b15952ebbbeb809cc5c523ab400f09fe03bb54f42ce35a3283bf4a3ba69e7856998353
SSDEEP 12288:Eh/Y+4TeH81jJUZv5PcLRVgC9uHX1YtzHtiv2yg5rrxXUYda2VNwoJsE/mWkv+Od:alr8MXcFaYU1Ytz1ps2PJsOo
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1064	2292	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 1064	2292	Invoice.exe	28
PID 2292 wrote to memory of 1064	2292	Invoice.exe	28
PID 2292 wrote to memory of 1064	2292	Invoice.exe	28
PID 2292 wrote to memory of 1064	2292	Invoice.exe	28

C:\Users\Admin\AppData\Local\Temp\Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 792
  2⤵
  - Program crash
  PID:1064

memory/2292-0-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Download

memory/2292-1-0x00000000010A0000-0x000000000116E000-memory.dmp

Download

memory/2292-2-0x0000000074B20000-0x000000007520E000-memory.dmp

Download

memory/2292-3-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Download

memory/2292-4-0x0000000074B20000-0x000000007520E000-memory.dmp

Download