0f09f8f60741e8b3c28dc927ff1b3318d8faa623d641704b605bc38142f54f28

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
13/11/2023, 12:48

Target

random.exe
Size

141KB
MD5

326781a332c7040492dc96b13fb126e5
SHA1

d03d8e89a6c75a14f512eeabf180a2f69d30e884
SHA256

0f09f8f60741e8b3c28dc927ff1b3318d8faa623d641704b605bc38142f54f28
SHA512

e701babafad09f1115511949f3061275bc6fbc54756d40f038aa9be708ff06736413367395bff7e157035aa9260ada439ad9a8d4c2c48c14de94c42f6ec0c2bc
SSDEEP

3072:Oq+kTdFfyZfJ+xjLkTVXbpL9FCOjrAJDH+9s9uAFfvUC:OkTdZy18JLgXbp9F5bo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2584	2436	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2584	2436	random.exe	28
PID 2436 wrote to memory of 2584	2436	random.exe	28
PID 2436 wrote to memory of 2584	2436	random.exe	28
PID 2436 wrote to memory of 2584	2436	random.exe	28

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 560
  2⤵
  - Program crash
  PID:2584

memory/2436-1-0x0000000073F30000-0x000000007461E000-memory.dmp

Filesize
6.9MB

Download
memory/2436-0-0x00000000012B0000-0x00000000012DA000-memory.dmp

Filesize
168KB

Download
memory/2436-2-0x0000000004D50000-0x0000000004D90000-memory.dmp

Filesize
256KB

Download
memory/2436-3-0x0000000073F30000-0x000000007461E000-memory.dmp

Filesize
6.9MB

Download
memory/2436-4-0x0000000004D50000-0x0000000004D90000-memory.dmp

Filesize
256KB

Download