c91407d19d47bb47a693034aed408516b0d7de899018630a64a99ea30598fc88

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 13:02

Target

95f3174ddd4667ce71817dba7dbfc9a3.exe
Size

55KB
MD5

95f3174ddd4667ce71817dba7dbfc9a3
SHA1

0ccf646781731e31a83644d27b2a86283ea7f929
SHA256

c91407d19d47bb47a693034aed408516b0d7de899018630a64a99ea30598fc88
SHA512

acda0d91d744f8fefd7ceac5383a95cf0ecadad43ae2b4c26edde244b7bea3cf3d03db73a054be72acfcb012e20bc3497567d0fc134015c06ac5a1bafa121881
SSDEEP

768:c508Nx0he9LllbD1zboMFngriR8Ai+olQzBCm02p/1H5CXdnh:cu8LLLllbJ3pngrTfazBi2Lq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
1712	1900	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 1712	1900	95f3174ddd4667ce71817dba7dbfc9a3.exe	16
PID 1900 wrote to memory of 1712	1900	95f3174ddd4667ce71817dba7dbfc9a3.exe	16
PID 1900 wrote to memory of 1712	1900	95f3174ddd4667ce71817dba7dbfc9a3.exe	16
PID 1900 wrote to memory of 1712	1900	95f3174ddd4667ce71817dba7dbfc9a3.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 140
1⤵
- Program crash
PID:1712

C:\Users\Admin\AppData\Local\Temp\95f3174ddd4667ce71817dba7dbfc9a3.exe
"C:\Users\Admin\AppData\Local\Temp\95f3174ddd4667ce71817dba7dbfc9a3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1900

memory/1900-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1900-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download