21fa73e927c871162b2b1cf5d4a5d431e3deff80dbd81d2b5c2243e485608f43

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 23:21 UTC

Target

191653fa2bf8eaf8e88065f6c0e01fcf.exe
Size

202KB
MD5

191653fa2bf8eaf8e88065f6c0e01fcf
SHA1

a809bd060b5ad85d3fa080094c36b67da667a631
SHA256

21fa73e927c871162b2b1cf5d4a5d431e3deff80dbd81d2b5c2243e485608f43
SHA512

8fb0a4e8ab7c85a3c9f438a2a5ce11c9c75b188cbdb6b78be0c6ba5f8e301518a123e8ae123920569349bbd390a0b7764d99779e5aab5d5c3a5cd0cc8f018ab5
SSDEEP

3072:BFaNOEksFuGj6YaFph/f2qHCpG/1WGK8OWQx2Hvag88Sx7NUMs8m0Jiu6/Ggv/a:qOEfum6/VcbR1mnu6/G8y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1640	2000	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1640	2000	191653fa2bf8eaf8e88065f6c0e01fcf.exe	28
PID 2000 wrote to memory of 1640	2000	191653fa2bf8eaf8e88065f6c0e01fcf.exe	28
PID 2000 wrote to memory of 1640	2000	191653fa2bf8eaf8e88065f6c0e01fcf.exe	28
PID 2000 wrote to memory of 1640	2000	191653fa2bf8eaf8e88065f6c0e01fcf.exe	28

C:\Users\Admin\AppData\Local\Temp\191653fa2bf8eaf8e88065f6c0e01fcf.exe
"C:\Users\Admin\AppData\Local\Temp\191653fa2bf8eaf8e88065f6c0e01fcf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 136
  2⤵
  - Program crash
  PID:1640

memory/2000-0-0x0000000000F90000-0x0000000000F9A000-memory.dmp

Filesize
40KB

Download
memory/2000-1-0x0000000000F90000-0x0000000000F9A000-memory.dmp

Filesize
40KB

Download