21c2f7df36e4f585c1111f6f8ec3e8e8c94afd9bccbf2a2505c020385c82c7b2

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
27/11/2023, 01:01

Target

21c2f7df36e4f585c1111f6f8ec3e8e8c94afd9bccbf2a2505c020385c82c7b2.exe
Size

13.9MB
MD5

ba0b887f6337bbc30889e4661c4a941c
SHA1

fac4ebd50b1820288a66a7774effd6362af85997
SHA256

21c2f7df36e4f585c1111f6f8ec3e8e8c94afd9bccbf2a2505c020385c82c7b2
SHA512

7ef64a1f2708eebf61af760ec211d901988faa692df38e74faec4f55cbe37a4bb58713b781be2b1aaee15095eb767f2aa180db84ea896d6991a585bca3af78b6
SSDEEP

393216:90kOEE8Ybb7ZAn57M+AGVU5C+dgYfx9ss:9e7lAn5xANgGgM3ss

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2904	1748	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2904	1748	21c2f7df36e4f585c1111f6f8ec3e8e8c94afd9bccbf2a2505c020385c82c7b2.exe	28
PID 1748 wrote to memory of 2904	1748	21c2f7df36e4f585c1111f6f8ec3e8e8c94afd9bccbf2a2505c020385c82c7b2.exe	28
PID 1748 wrote to memory of 2904	1748	21c2f7df36e4f585c1111f6f8ec3e8e8c94afd9bccbf2a2505c020385c82c7b2.exe	28
PID 1748 wrote to memory of 2904	1748	21c2f7df36e4f585c1111f6f8ec3e8e8c94afd9bccbf2a2505c020385c82c7b2.exe	28

C:\Users\Admin\AppData\Local\Temp\21c2f7df36e4f585c1111f6f8ec3e8e8c94afd9bccbf2a2505c020385c82c7b2.exe
"C:\Users\Admin\AppData\Local\Temp\21c2f7df36e4f585c1111f6f8ec3e8e8c94afd9bccbf2a2505c020385c82c7b2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 304
  2⤵
  - Program crash
  PID:2904

memory/1748-0-0x0000000000400000-0x000000000199B000-memory.dmp

Filesize
21.6MB

Download
memory/1748-1-0x00000000053F0000-0x00000000057B2000-memory.dmp

Filesize
3.8MB

Download
memory/1748-3-0x00000000053F0000-0x00000000057B2000-memory.dmp

Filesize
3.8MB

Download
memory/1748-5-0x00000000053F0000-0x00000000057B2000-memory.dmp

Filesize
3.8MB

Download
memory/1748-7-0x00000000053F0000-0x00000000057B2000-memory.dmp

Filesize
3.8MB

Download
memory/1748-11-0x00000000053F0000-0x00000000057B2000-memory.dmp

Filesize
3.8MB

Download
memory/1748-15-0x00000000053F0000-0x00000000057B2000-memory.dmp

Filesize
3.8MB

Download
memory/1748-19-0x00000000053F0000-0x00000000057B2000-memory.dmp

Filesize
3.8MB

Download
memory/1748-23-0x00000000053F0000-0x00000000057B2000-memory.dmp

Filesize
3.8MB

Download
memory/1748-27-0x00000000053F0000-0x00000000057B2000-memory.dmp

Filesize
3.8MB

Download
memory/1748-26-0x00000000053F0000-0x00000000057B2000-memory.dmp

Filesize
3.8MB

Download
memory/1748-28-0x0000000000400000-0x000000000199B000-memory.dmp

Filesize
21.6MB

Download