b491da1816eca7bd5cd7c23dbb5796eee76c0bc6f3f612679d83264f4ec6988f

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/12/2023, 15:34

Target

507e1da16fd236efb73efb499f63e82c.exe
Size

352KB
MD5

507e1da16fd236efb73efb499f63e82c
SHA1

a2fc40fe61320ad7612c7a2173431dc7684c5640
SHA256

b491da1816eca7bd5cd7c23dbb5796eee76c0bc6f3f612679d83264f4ec6988f
SHA512

1d3d710be86af602f798ad9807ba3fa76ff21de995814ba4733b5fc2f46facb9c54b92a4bb3ff8d85e94fe3b70c98950c9bc12d8b85a88e6bf7a362cba5c2bc9
SSDEEP

6144:nYdJtZQ2ZX2ZB2LHjRgXD1MJMLw2xW2qdJ6Q9Ge6sh2RyEcOm2bvLhlRTI0Xo:YdJtZQ2ZX2ZB2LHjRgXD1MIxBQJ9Ge6i

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2264	1364	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 2264	1364	507e1da16fd236efb73efb499f63e82c.exe	28
PID 1364 wrote to memory of 2264	1364	507e1da16fd236efb73efb499f63e82c.exe	28
PID 1364 wrote to memory of 2264	1364	507e1da16fd236efb73efb499f63e82c.exe	28
PID 1364 wrote to memory of 2264	1364	507e1da16fd236efb73efb499f63e82c.exe	28

C:\Users\Admin\AppData\Local\Temp\507e1da16fd236efb73efb499f63e82c.exe
"C:\Users\Admin\AppData\Local\Temp\507e1da16fd236efb73efb499f63e82c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 108
  2⤵
  - Program crash
  PID:2264

memory/1364-0-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download