be4d23c7a2ff6bd0a2f74734e18faae796fe0ffa11987528fbd8673a2a0f2fb3

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
17/07/2024, 06:27

Target
Shipping Documents 7896424100.exe
Size 1.1MB
Sample240717-g7rn6asare
SHA256 be4d23c7a2ff6bd0a2f74734e18faae796fe0ffa11987528fbd8673a2a0f2fb3
MD5 b5885593d5c1612710aa6f05f5f94ceb
SHA1 d7e3582b41794915506c30387d2034cf37848a7c
SHA512 adad3b1922a683514f4f1d63ad25289bea9bc3adef04d3b1e87862f668848a6ad375eb8afc730f6fec73901d65dae6ee8fe0f0dea74531d6ee920a9f38e32031
SSDEEP 24576:NAHnh+eWsN3skA4RV1Hom2KXMmHaf6wGMfn3M6Xg+/65:sh+ZkldoPK8YafB3M6Q+4
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3632	2556	WerFault.exe	83

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2556	Shipping Documents 7896424100.exe
2556	Shipping Documents 7896424100.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 4216	2556	Shipping Documents 7896424100.exe	87
PID 2556 wrote to memory of 4216	2556	Shipping Documents 7896424100.exe	87
PID 2556 wrote to memory of 4216	2556	Shipping Documents 7896424100.exe	87

C:\Users\Admin\AppData\Local\Temp\Shipping Documents 7896424100.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping Documents 7896424100.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\Shipping Documents 7896424100.exe"
  2⤵
  PID:4216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 660
  2⤵
  - Program crash
  PID:3632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2556 -ip 2556
1⤵
PID:2452

autB14E.tmp

Path C:\Users\Admin\AppData\Local\Temp\autB14E.tmp
Size 264KB
SHA256 4bc2fae702ea3986d2e66cc8cbccdbc3b85acdf6e44b065b547915a0f34a60f7
MD5 627688ef8c5b754f7cce8492ea776cb4
SHA1 c7c47cef31e83cd5ef37fa33ef37da4209e7f175
SHA512 53c52970ae92642e3b9aed035ecf8e1ebfaa556466809c2d303012342b07e3a96ae2cc159fdd4cc638efb0184c760ae767b6f65fcbdeea1e85f93d34929d19f1
SSDEEP 6144:u+vmU/MWFrhSm9F51dB+rAqVcSBSvCAJ4+VRQnqnx9IGpBDu:uRU0W59F5C3BRAC+V6snIGq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2556-12-0x0000000000DF0000-0x0000000000DF4000-memory.dmp

Download