77dddffa09911de18be9426fdd22a8f919a5317e92127998a6d55b1637bd9808

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 21:46

Target

139f77f1567ede1f9e0a3673cbb63d7e.exe
Size

118KB
MD5

139f77f1567ede1f9e0a3673cbb63d7e
SHA1

438470b78a8bd390578b7fd8ec01801f78a1aded
SHA256

77dddffa09911de18be9426fdd22a8f919a5317e92127998a6d55b1637bd9808
SHA512

b8e7657929d75df1e6b78aac5c48085aee760bcf3c38ad98d30af27187d82954d324f403d4de39454bc6d8084ccbc81c4e0b41ae18aea5425bf12877ca03da81
SSDEEP

1536:dbdo6pwas3BEBGviCxaOdHJTLusq/LpqXNWfBPLDFZLlKtrs/oWXZtS:db+uwZx3vij+JdK49WfhhKtA/Lu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2168	1680	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2168	1680	139f77f1567ede1f9e0a3673cbb63d7e.exe	14
PID 1680 wrote to memory of 2168	1680	139f77f1567ede1f9e0a3673cbb63d7e.exe	14
PID 1680 wrote to memory of 2168	1680	139f77f1567ede1f9e0a3673cbb63d7e.exe	14
PID 1680 wrote to memory of 2168	1680	139f77f1567ede1f9e0a3673cbb63d7e.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 168
1⤵
- Program crash
PID:2168

C:\Users\Admin\AppData\Local\Temp\139f77f1567ede1f9e0a3673cbb63d7e.exe
"C:\Users\Admin\AppData\Local\Temp\139f77f1567ede1f9e0a3673cbb63d7e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1680

memory/1680-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download