b51e330f366a7a0f9adb00888ac4104ebc670f71de73f21766bedb25c29bd797

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19/07/2023, 12:34

Target

e27abc30afbe00exe_JC.exe
Size

191KB
MD5

e27abc30afbe00cba2e8e58263f7f4bc
SHA1

25b25d638eb3ff2797b58f15ffc7ba0e89ec7f8b
SHA256

b51e330f366a7a0f9adb00888ac4104ebc670f71de73f21766bedb25c29bd797
SHA512

3fcdb5317903e4b03e9efd50169ce9e154163288fc14b996e8c6ef2c0920a9ff114fbc203049a2d075ffeb0581e445a136d328ff909ca4caa4c3877376f67f42
SSDEEP

3072:Olh5gC540Hj5TVuzRw4V020Ypn+AiNM2tGJQlc2Rk1v07wd0ktVs127VzPRKm6:Oz54AvCw4V020ptcku6w+ktVs1y6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2776	2056	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2776	2056	e27abc30afbe00exe_JC.exe	28
PID 2056 wrote to memory of 2776	2056	e27abc30afbe00exe_JC.exe	28
PID 2056 wrote to memory of 2776	2056	e27abc30afbe00exe_JC.exe	28
PID 2056 wrote to memory of 2776	2056	e27abc30afbe00exe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\e27abc30afbe00exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\e27abc30afbe00exe_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 36
  2⤵
  - Program crash
  PID:2776

memory/2056-54-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2056-55-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download