001b7fa6b0ef402d2ab4f10403d6e9867c9d9c6493b99392f2cdb63bc2631422

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 11:13

Target

2333.exe
Size

214KB
MD5

bb442e94cb74cb48bcccfb945bbcea9b
SHA1

6d5d7c0e383b47aae6ecd5b9ce96ad6c14dba020
SHA256

001b7fa6b0ef402d2ab4f10403d6e9867c9d9c6493b99392f2cdb63bc2631422
SHA512

b22f5f4cc8dd2d48fa09449b243c8fa04d06823a0e812eb30ed1da49d1f07907a2f91d42e10d46d77e2be7c8bbfacb3cefae2bac6b152f4006ce205849f2294d
SSDEEP

3072:KPq8/wnXAhtwHU6el6VG6Wyl1r0LgLwlzL1P9C6czjCuOmH3tunQVo6:5X2wHU6el6g6WylF0LgsdE/CuU6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2380	2820	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2380	2820	2333.exe	28
PID 2820 wrote to memory of 2380	2820	2333.exe	28
PID 2820 wrote to memory of 2380	2820	2333.exe	28
PID 2820 wrote to memory of 2380	2820	2333.exe	28

C:\Users\Admin\AppData\Local\Temp\2333.exe
"C:\Users\Admin\AppData\Local\Temp\2333.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 876
  2⤵
  - Program crash
  PID:2380

memory/2820-0-0x0000000000A30000-0x0000000000A6A000-memory.dmp

Filesize
232KB

Download
memory/2820-1-0x0000000074630000-0x0000000074D1E000-memory.dmp

Filesize
6.9MB

Download
memory/2820-2-0x0000000005250000-0x0000000005290000-memory.dmp

Filesize
256KB

Download
memory/2820-3-0x0000000074630000-0x0000000074D1E000-memory.dmp

Filesize
6.9MB

Download
memory/2820-4-0x0000000005250000-0x0000000005290000-memory.dmp

Filesize
256KB

Download