57fc066ed4b0d7000427e0f9982ca238aa3fe378f307c51a88e8a09423b9c0f2

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 04:54

Target

PaymentAdvice.exe
Size

250KB
MD5

6a9209198711b88b06ed9834692ca1c8
SHA1

1f25855e8d81f9898689edbfbc0458a862d29663
SHA256

33d3af05d1fcf28764c48629687647f8a765d4dfccee946a470356366f521387
SHA512

35142e44c94cd2fceb726ed0ebf5065878bf0a085d3092a6f8e7302033cb885da163a1d8fc61d23f23280257a3f2aacd67add75d0cd949cc55157cbdde169d99
SSDEEP

3072:svecvGokz8uuewZe4qhkALYf+M2cOaiT62nSxZv1xFddEnkwoJIlePAm1AdV:svNKz8ZFZP6k+htxtSfrw6IRiAX

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4572 3592 WerFault.exe PaymentAdvice.exe

pid	pid_target	process	target process
4572	3592	WerFault.exe	PaymentAdvice.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

PaymentAdvice.exe

description	pid	process	target process
PID 3592 wrote to memory of 1340	3592	PaymentAdvice.exe	PaymentAdvice.exe
PID 3592 wrote to memory of 1340	3592	PaymentAdvice.exe	PaymentAdvice.exe
PID 3592 wrote to memory of 1340	3592	PaymentAdvice.exe	PaymentAdvice.exe

C:\Users\Admin\AppData\Local\Temp\PaymentAdvice.exe
"C:\Users\Admin\AppData\Local\Temp\PaymentAdvice.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3592

C:\Users\Admin\AppData\Local\Temp\PaymentAdvice.exe
"C:\Users\Admin\AppData\Local\Temp\PaymentAdvice.exe"
2⤵
PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 512
2⤵
- Program crash
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3592 -ip 3592
1⤵
PID:3032

memory/3592-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3592-1-0x00000000004F0000-0x00000000004F2000-memory.dmp

Filesize
8KB

Download