3d0c27b37f1fa972317724f7394afc9cf18a4d30ca185c05f99e67c793a42d66

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 23:15

Target

18b5317d129d634867f49243fc43b987.exe
Size

32KB
MD5

18b5317d129d634867f49243fc43b987
SHA1

d505525598733501267d6aa8dc65641344ed588a
SHA256

3d0c27b37f1fa972317724f7394afc9cf18a4d30ca185c05f99e67c793a42d66
SHA512

098555c97fd837d6f5ddf07660150527099f5ffb8c3bea77830134dcb3373c8c373e6572cbfcfc468d7121921e172d3e40c5074255743f6f34a2eed1453a22c7
SSDEEP

384:qnBlWzawGJSq/4e9q+9Qi0T2rw1YI62hIUza/R7I9bMa2Op:I9wwSLN+9Qi0eoVT6YM744+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1556	840	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 1556	840	18b5317d129d634867f49243fc43b987.exe	28
PID 840 wrote to memory of 1556	840	18b5317d129d634867f49243fc43b987.exe	28
PID 840 wrote to memory of 1556	840	18b5317d129d634867f49243fc43b987.exe	28
PID 840 wrote to memory of 1556	840	18b5317d129d634867f49243fc43b987.exe	28

C:\Users\Admin\AppData\Local\Temp\18b5317d129d634867f49243fc43b987.exe
"C:\Users\Admin\AppData\Local\Temp\18b5317d129d634867f49243fc43b987.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 88
  2⤵
  - Program crash
  PID:1556

memory/840-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download