293ba40b1cb108c5d5f6f069bafe89cfbf1e970efaf82020dbf25992102948a0

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:15

Target

LETTER-PROFORMA-APPOINTMENT-DOCX.exe
Size

695KB
MD5

dc5efebad778fed9a844ef6faef4d156
SHA1

0708cdc4ebb6225dfe99b4dee80a2513760583ab
SHA256

293ba40b1cb108c5d5f6f069bafe89cfbf1e970efaf82020dbf25992102948a0
SHA512

9e371d298c345fc7333ff6eea8720fbb3c05e76718197d44068cdcaec09f5c79abed709f9381222cdc25f57b4ea72086bad83297ce7cc9529538105a15d0a2e7
SSDEEP

12288:vNi8LkpEa+4hzx/HQZaJSDQOk8mekzq7R0N5wJRHT41OIm2/lzXMz5I1ntc3DZ2M:AjEI/HgaJSnZOzvuHT4oIN5ei1n4n

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

LETTER-PROFORMA-APPOINTMENT-DOCX.exe

description pid process target process

PID 384 set thread context of 2852 384 LETTER-PROFORMA-APPOINTMENT-DOCX.exe LETTER-PROFORMA-APPOINTMENT-DOCX.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2012 2852 WerFault.exe LETTER-PROFORMA-APPOINTMENT-DOCX.exe

description	pid	process	target process
PID 384 set thread context of 2852	384	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	LETTER-PROFORMA-APPOINTMENT-DOCX.exe

pid	pid_target	process	target process
2012	2852	WerFault.exe	LETTER-PROFORMA-APPOINTMENT-DOCX.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

LETTER-PROFORMA-APPOINTMENT-DOCX.exeLETTER-PROFORMA-APPOINTMENT-DOCX.exe

description	pid	process	target process
PID 384 wrote to memory of 2852	384	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	LETTER-PROFORMA-APPOINTMENT-DOCX.exe
PID 384 wrote to memory of 2852	384	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	LETTER-PROFORMA-APPOINTMENT-DOCX.exe
PID 384 wrote to memory of 2852	384	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	LETTER-PROFORMA-APPOINTMENT-DOCX.exe
PID 384 wrote to memory of 2852	384	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	LETTER-PROFORMA-APPOINTMENT-DOCX.exe
PID 384 wrote to memory of 2852	384	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	LETTER-PROFORMA-APPOINTMENT-DOCX.exe
PID 384 wrote to memory of 2852	384	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	LETTER-PROFORMA-APPOINTMENT-DOCX.exe
PID 384 wrote to memory of 2852	384	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	LETTER-PROFORMA-APPOINTMENT-DOCX.exe
PID 2852 wrote to memory of 2012	2852	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	WerFault.exe
PID 2852 wrote to memory of 2012	2852	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	WerFault.exe
PID 2852 wrote to memory of 2012	2852	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	WerFault.exe
PID 2852 wrote to memory of 2012	2852	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\LETTER-PROFORMA-APPOINTMENT-DOCX.exe
"C:\Users\Admin\AppData\Local\Temp\LETTER-PROFORMA-APPOINTMENT-DOCX.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 36
3⤵
- Program crash
PID:2012

memory/384-0-0x0000000074BBE000-0x0000000074BBF000-memory.dmp

Filesize
4KB

Download
memory/384-1-0x00000000009B0000-0x0000000000A64000-memory.dmp

Filesize
720KB

Download
memory/384-2-0x0000000074BB0000-0x000000007529E000-memory.dmp

Filesize
6.9MB

Download
memory/384-3-0x0000000000920000-0x000000000093A000-memory.dmp

Filesize
104KB

Download
memory/384-4-0x0000000000490000-0x00000000004A0000-memory.dmp

Filesize
64KB

Download
memory/384-5-0x0000000005420000-0x00000000054AA000-memory.dmp

Filesize
552KB

Download
memory/384-12-0x0000000074BB0000-0x000000007529E000-memory.dmp

Filesize
6.9MB

Download
memory/2852-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2852-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2852-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2852-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download