2d0ad86a69623b783158a08e994cf4fcb85b3d5bccaebdad75311cdef9bc8977

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22/10/2023, 11:41

Target

2d0ad86a69623b783158a08e994cf4fcb85b3d5bccaebdad75311cdef9bc8977.exe
Size

7.6MB
MD5

0cfe40a704fde11fa53a429d6d31b11f
SHA1

ae101b112cfebfe433bbe9943308d0eb4a0d0dd9
SHA256

2d0ad86a69623b783158a08e994cf4fcb85b3d5bccaebdad75311cdef9bc8977
SHA512

2940e523391f5b559273c7f2de0517596f73d9c79d4010c917e7ef1640f4e258d9dc74e71e01218b4469d467fca3f01e7e7bce67bee18ec774a81d5730629589
SSDEEP

196608:VV8Mp+ek/HBWAHQY394wj1kB9MjFAILF+TvC6K:VVZtQkbwj1aMuIuvR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2476	1716	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2476	1716	2d0ad86a69623b783158a08e994cf4fcb85b3d5bccaebdad75311cdef9bc8977.exe	29
PID 1716 wrote to memory of 2476	1716	2d0ad86a69623b783158a08e994cf4fcb85b3d5bccaebdad75311cdef9bc8977.exe	29
PID 1716 wrote to memory of 2476	1716	2d0ad86a69623b783158a08e994cf4fcb85b3d5bccaebdad75311cdef9bc8977.exe	29
PID 1716 wrote to memory of 2476	1716	2d0ad86a69623b783158a08e994cf4fcb85b3d5bccaebdad75311cdef9bc8977.exe	29

C:\Users\Admin\AppData\Local\Temp\2d0ad86a69623b783158a08e994cf4fcb85b3d5bccaebdad75311cdef9bc8977.exe
"C:\Users\Admin\AppData\Local\Temp\2d0ad86a69623b783158a08e994cf4fcb85b3d5bccaebdad75311cdef9bc8977.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 48
  2⤵
  - Program crash
  PID:2476

memory/1716-0-0x00000000003F0000-0x0000000000B83000-memory.dmp

Filesize
7.6MB

Download