cfac588e812194bb17252292d5ae234eb67a6c6cae360c9a6e5b73b9b0155b96

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
26/11/2023, 19:01

Target

fed7fafa9fc14bee836330f61ca12620.exe
Size

208KB
MD5

fed7fafa9fc14bee836330f61ca12620
SHA1

ea3ad4a83abfa818e723c3b2c507baae862f6320
SHA256

cfac588e812194bb17252292d5ae234eb67a6c6cae360c9a6e5b73b9b0155b96
SHA512

c771bba9d54b603c60a38ad9e55b9fc6498a662a3f8abdec9b6836a851d0d80e275519d0a40e48eb2576697b78dcf436f39442098d62c79ccb34c2863b05d9af
SSDEEP

768:TWixLkP3pyIHMXlpPS5ZyneeekIt/xjTFuaU4ZUSJF/1H5tvXdnh:TWiu3bs1miePRxTmsl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3060	2044	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 3060	2044	fed7fafa9fc14bee836330f61ca12620.exe	28
PID 2044 wrote to memory of 3060	2044	fed7fafa9fc14bee836330f61ca12620.exe	28
PID 2044 wrote to memory of 3060	2044	fed7fafa9fc14bee836330f61ca12620.exe	28
PID 2044 wrote to memory of 3060	2044	fed7fafa9fc14bee836330f61ca12620.exe	28

C:\Users\Admin\AppData\Local\Temp\fed7fafa9fc14bee836330f61ca12620.exe
"C:\Users\Admin\AppData\Local\Temp\fed7fafa9fc14bee836330f61ca12620.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 36
  2⤵
  - Program crash
  PID:3060

memory/2044-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download