a135b28345728e0533bf4bdad442dfee04d2e6f67e9b04ebb088919ef18d6601

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 11:34

Target

Customer Advisory - HS Code - Maersk Shipping.ppt.exe
Size

947KB
MD5

23f0cf81aa7d1c7a4a23e95e5a2595e4
SHA1

0e477abeb86ae366d906a247e8f30b4ccdc02eef
SHA256

a135b28345728e0533bf4bdad442dfee04d2e6f67e9b04ebb088919ef18d6601
SHA512

208db7a72859d78a9b9ee235f78ae55b3fbc05fec9c475c5aaf66ffd50e4d9c16d58620473a21ffd0c19874b4906f9c0b7b1e77b6bd22f9cf87789ad3d4ab0e9
SSDEEP

24576:/YTyQ+R2J+E34ppWnRM/ggnlWWf5tlD7k:/pbkJqbMWBtN

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2616 2100 WerFault.exe Customer Advisory - HS Code - Maersk Shipping.ppt.exe

pid	pid_target	process	target process
2616	2100	WerFault.exe	Customer Advisory - HS Code - Maersk Shipping.ppt.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Customer Advisory - HS Code - Maersk Shipping.ppt.exe

description	pid	process	target process
PID 2100 wrote to memory of 2616	2100	Customer Advisory - HS Code - Maersk Shipping.ppt.exe	WerFault.exe
PID 2100 wrote to memory of 2616	2100	Customer Advisory - HS Code - Maersk Shipping.ppt.exe	WerFault.exe
PID 2100 wrote to memory of 2616	2100	Customer Advisory - HS Code - Maersk Shipping.ppt.exe	WerFault.exe
PID 2100 wrote to memory of 2616	2100	Customer Advisory - HS Code - Maersk Shipping.ppt.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Customer Advisory - HS Code - Maersk Shipping.ppt.exe
"C:\Users\Admin\AppData\Local\Temp\Customer Advisory - HS Code - Maersk Shipping.ppt.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 700
  2⤵
  - Program crash
  PID:2616

memory/2100-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2100-1-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download