1662a5cc4249e46fc25f5b62dc8eb62eb5607d72473474f1c2a810ee7499e3f4

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 23:17

Target

18cb58715bb2880d577432fc6e03526a.exe
Size

467KB
MD5

18cb58715bb2880d577432fc6e03526a
SHA1

56ca41f2420dc7c7d87956f5633ab1e7d2d9161c
SHA256

1662a5cc4249e46fc25f5b62dc8eb62eb5607d72473474f1c2a810ee7499e3f4
SHA512

5b69066e9a3109a9ed6ad3cb4dafae7507d997473b8b86f1a9247335b9fb632ad861716d3050c1cfe0ad23b4207d34a9bb82b87b18ab3823021706a5f095d801
SSDEEP

12288:mqFd4IPu7um5zzNKz5daWM1t6J3ID2ek1gH7TZ7YrXHKv:mqFmIPu7um5zzNKHMX65ID2ek1gH7TZR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2164	1736	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2164	1736	18cb58715bb2880d577432fc6e03526a.exe	14
PID 1736 wrote to memory of 2164	1736	18cb58715bb2880d577432fc6e03526a.exe	14
PID 1736 wrote to memory of 2164	1736	18cb58715bb2880d577432fc6e03526a.exe	14
PID 1736 wrote to memory of 2164	1736	18cb58715bb2880d577432fc6e03526a.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 124
1⤵
- Program crash
PID:2164

C:\Users\Admin\AppData\Local\Temp\18cb58715bb2880d577432fc6e03526a.exe
"C:\Users\Admin\AppData\Local\Temp\18cb58715bb2880d577432fc6e03526a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736

memory/1736-0-0x0000000000880000-0x00000000008CD000-memory.dmp

Filesize
308KB

Download
memory/1736-1-0x0000000000880000-0x00000000008CD000-memory.dmp

Filesize
308KB

Download