e2c19af86e636ce274becc52a153bcf2b80da7d7c0aca8dabd3c67ded084560d

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 23:50

Target

1acf00298e367a68fc03859f7db00dcf.exe
Size

339KB
MD5

1acf00298e367a68fc03859f7db00dcf
SHA1

67ab6bb77b54ae76ff3f766345cebcf46c98b86b
SHA256

e2c19af86e636ce274becc52a153bcf2b80da7d7c0aca8dabd3c67ded084560d
SHA512

e215f513df12bf9b720def3777e2a17efb0e13ead7ed9c367a64d5efac064cfbad63ccd734e43a3fe80fb1c9d7a8824eb780053eb4643770464632ce85708689
SSDEEP

6144:Z2uB1fO9Tcoux971Zhm6zAaeB4dR1VAooWFlKyxv41OMFQ7KLHxOZvNovLsQ:j1m9Ib9EcA94d/53cVFQ7URO0vLZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1612	1696	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1612	1696	1acf00298e367a68fc03859f7db00dcf.exe	28
PID 1696 wrote to memory of 1612	1696	1acf00298e367a68fc03859f7db00dcf.exe	28
PID 1696 wrote to memory of 1612	1696	1acf00298e367a68fc03859f7db00dcf.exe	28
PID 1696 wrote to memory of 1612	1696	1acf00298e367a68fc03859f7db00dcf.exe	28

C:\Users\Admin\AppData\Local\Temp\1acf00298e367a68fc03859f7db00dcf.exe
"C:\Users\Admin\AppData\Local\Temp\1acf00298e367a68fc03859f7db00dcf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 36
  2⤵
  - Program crash
  PID:1612

memory/1696-1-0x0000000001000000-0x00000000010A4000-memory.dmp

Filesize
656KB

Download
memory/1696-0-0x0000000001000000-0x00000000010A4000-memory.dmp

Filesize
656KB

Download
memory/1696-2-0x0000000001000000-0x00000000010A4000-memory.dmp

Filesize
656KB

Download