ea420f9984d23448664b6de080f1b668f0a970ad48ad5c4e122fb09b48faa42c

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 15:51

Target
Ofx AUDIENCIA REF 110016020240201837955.exe
Size 3.9MB
Sample240531-tap6aadb3s
SHA256 56a6c96ea14b7e2eae502672540789740c93322f548f5ab62bd5b993f437534d
MD5 4ffdd7cae1c3e36fbdadfed4091e4513
SHA1 557d79718181745fadf3734ec1703cbd5286718c
SHA512 d5bc7c7cf2519fa6846e4d9b9122a32fffcd0258526e4408e6123b13c53ef38726bb26dd2ce090e0c2dbe7d1e9118ea991064d7580b65ab0757868738d7fc0c2
SSDEEP 49152:yW3tLBcXqclaR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTqOkbXS2eCOBBZA+7bu0:/tLuNqgwh4NYxtJpkxhGykVXX53333v
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
356	3052	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 356	3052	Ofx AUDIENCIA REF 110016020240201837955.exe	28
PID 3052 wrote to memory of 356	3052	Ofx AUDIENCIA REF 110016020240201837955.exe	28
PID 3052 wrote to memory of 356	3052	Ofx AUDIENCIA REF 110016020240201837955.exe	28
PID 3052 wrote to memory of 356	3052	Ofx AUDIENCIA REF 110016020240201837955.exe	28

C:\Users\Admin\AppData\Local\Temp\Ofx AUDIENCIA REF 110016020240201837955.exe
"C:\Users\Admin\AppData\Local\Temp\Ofx AUDIENCIA REF 110016020240201837955.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 204
  2⤵
  - Program crash
  PID:356

memory/3052-0-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/3052-2-0x0000000000521000-0x000000000053B000-memory.dmp

Download