3102e2f48abedbcfc41a989aadc08850348c124060e399f2c9b9250762fbcdbf

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 14:39

Target

01b469d016da4b9220c074e7373e47f5.exe
Size

314KB
MD5

01b469d016da4b9220c074e7373e47f5
SHA1

9dc4c42c5d527aa4e1b75dc53b531dab210fd068
SHA256

3102e2f48abedbcfc41a989aadc08850348c124060e399f2c9b9250762fbcdbf
SHA512

150f628bc81265eb4568b8f0bf533ad64da3434d25e14a4e74cb3e18f9ce2242f110824c937d6aa8e389c9965b56180739e5c1c95eea36e165e2e6ee40f3d168
SSDEEP

6144:0iiEZ7Zl1ndXQDQURvOQzh7Mx9nUv5tOdPOUGIiA91Inm5gaThgQ:0pm1ndXNU29nUfsb7Inmq+uQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2136	2432	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2136	2432	01b469d016da4b9220c074e7373e47f5.exe	28
PID 2432 wrote to memory of 2136	2432	01b469d016da4b9220c074e7373e47f5.exe	28
PID 2432 wrote to memory of 2136	2432	01b469d016da4b9220c074e7373e47f5.exe	28
PID 2432 wrote to memory of 2136	2432	01b469d016da4b9220c074e7373e47f5.exe	28

C:\Users\Admin\AppData\Local\Temp\01b469d016da4b9220c074e7373e47f5.exe
"C:\Users\Admin\AppData\Local\Temp\01b469d016da4b9220c074e7373e47f5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 160
  2⤵
  - Program crash
  PID:2136

memory/2432-0-0x0000000001280000-0x00000000012A7000-memory.dmp

Filesize
156KB

Download
memory/2432-1-0x0000000001280000-0x00000000012A7000-memory.dmp

Filesize
156KB

Download