983748c25d0701763e2d22718371bc136838148f1d0918778906da5d52617f26

Analysis

max time kernel
118s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-12-2023 12:39

Target

1/内容.exe
Size

167KB
MD5

b30d517585fefa8cd92a0af9d3193b87
SHA1

716cc624c33e168adfecab2a0d26f1af2526fdd2
SHA256

22ab670f9dcaf146d719e864fc3e01b0f5bd4d587834366c8b5dcd78f677f310
SHA512

fd8c0f629cdaf963d0d592edc591efdae75e922664cca552d4b1ab08d416f52aa534fbb5e4ca0f5d8a22f40d68933e92201296942e41bb57da39b778bb55e394
SSDEEP

3072:lQUcrL6KmL783vtpkBAoH66Gop/q/rQms3cp6L8EcSufWr7+tvZZsXILNeujvcu2:lQfSKm/6kBoRop/q/rQm6k6QEcSzr6tk

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2596 2556 WerFault.exe 内容.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

内容.exe

pid process

2556 内容.exe

pid	pid_target	process	target process
2596	2556	WerFault.exe	内容.exe

pid	process
2556	内容.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

内容.exe

description	pid	process	target process
PID 2556 wrote to memory of 2596	2556	内容.exe	WerFault.exe
PID 2556 wrote to memory of 2596	2556	内容.exe	WerFault.exe
PID 2556 wrote to memory of 2596	2556	内容.exe	WerFault.exe
PID 2556 wrote to memory of 2596	2556	内容.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 756
2⤵
- Program crash
PID:2596