77f8b79e7dea2a7e4d2a947522bb92604c26cb77b5bf29744af9ccf46dd4f429

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 23:29

Target

19ad28bf718823a74d915ce07f09b9d5.exe
Size

11KB
MD5

19ad28bf718823a74d915ce07f09b9d5
SHA1

9c9b5158e339ecb8445b3cb62c397b0d5a6e50eb
SHA256

77f8b79e7dea2a7e4d2a947522bb92604c26cb77b5bf29744af9ccf46dd4f429
SHA512

9822e2993a0af27f9bb88aff574c22637e5bde0e07c5efc948b0cc0001645c32c9c45efc3be206820751a8bfbc7a649e9d168a5b53e5ef4a30484fce6a817c9d
SSDEEP

192:bGxoa9SW3l0vdV+A/XMXQneVqlfl7IRRrKFWzkwjFDk7LSTP7rcM:bGJH2vDdblNkRRr1lKLa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3056	3040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 3056	3040	19ad28bf718823a74d915ce07f09b9d5.exe	28
PID 3040 wrote to memory of 3056	3040	19ad28bf718823a74d915ce07f09b9d5.exe	28
PID 3040 wrote to memory of 3056	3040	19ad28bf718823a74d915ce07f09b9d5.exe	28
PID 3040 wrote to memory of 3056	3040	19ad28bf718823a74d915ce07f09b9d5.exe	28

C:\Users\Admin\AppData\Local\Temp\19ad28bf718823a74d915ce07f09b9d5.exe
"C:\Users\Admin\AppData\Local\Temp\19ad28bf718823a74d915ce07f09b9d5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 164
  2⤵
  - Program crash
  PID:3056

memory/3040-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3040-1-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download