2049559db8c2ef2946b2006aa828b7c425ac3bb96860d842e909d7488aefae29

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16/08/2023, 11:07

Target

2049559db8c2ef2946b2006aa828b7c425ac3bb96860d842e909d7488aefae29.exe
Size

95KB
MD5

2011032b5037523ae3af850554977228
SHA1

918e8220e5509d575a3755a5c6c36595e647ce1a
SHA256

2049559db8c2ef2946b2006aa828b7c425ac3bb96860d842e909d7488aefae29
SHA512

26f8863df27dd5940986d3da9a7f07ad6f1268b084b97188712680891c67fee80837af096f243de28d956cf440f418712d4f773adf78968450561cc1351562a5
SSDEEP

1536:+jbRe3mTedgPmx5z8aWqSNaNy+3n6ifqRsWFd09dlVrrmPV:+jbRWmSCPg5HQuy+3lfGMHeN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1976	1672	WerFault.exe	23

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1976	1672	2049559db8c2ef2946b2006aa828b7c425ac3bb96860d842e909d7488aefae29.exe	28
PID 1672 wrote to memory of 1976	1672	2049559db8c2ef2946b2006aa828b7c425ac3bb96860d842e909d7488aefae29.exe	28
PID 1672 wrote to memory of 1976	1672	2049559db8c2ef2946b2006aa828b7c425ac3bb96860d842e909d7488aefae29.exe	28

C:\Users\Admin\AppData\Local\Temp\2049559db8c2ef2946b2006aa828b7c425ac3bb96860d842e909d7488aefae29.exe
"C:\Users\Admin\AppData\Local\Temp\2049559db8c2ef2946b2006aa828b7c425ac3bb96860d842e909d7488aefae29.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1672 -s 32
  2⤵
  - Program crash
  PID:1976

memory/1672-55-0x00000000005C0000-0x0000000000640000-memory.dmp

Filesize
512KB

Download
memory/1672-56-0x00000000005C0000-0x0000000000640000-memory.dmp

Filesize
512KB

Download