1017c8929be03d97c808369f7dba05409fa19abf76105cd3cb64aa8694883bd9

Analysis

max time kernel
118s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 14:29

Target

00fc888ab2a6a6c18fc90ef687138565.exe
Size

635KB
MD5

00fc888ab2a6a6c18fc90ef687138565
SHA1

7288155b273cc27191775439df4cad8e4cbaae4b
SHA256

1017c8929be03d97c808369f7dba05409fa19abf76105cd3cb64aa8694883bd9
SHA512

5833b6e7c7096aea751b4187934294074dff307115ea8ebe2e611c6eeea78aa1db1455d59d89e6e71c7faafdba331beba48de0cf8452d95bfaa85fbe5867bc30
SSDEEP

12288:lc6YMnD8BziT9BbDYYYYYYLvlJTm49oQZ6fWMT0sflge7E:lc4QViTzLvlA49QuMT0sfCl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2804	2788	WerFault.exe	1

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 2804	2788	00fc888ab2a6a6c18fc90ef687138565.exe	30
PID 2788 wrote to memory of 2804	2788	00fc888ab2a6a6c18fc90ef687138565.exe	30
PID 2788 wrote to memory of 2804	2788	00fc888ab2a6a6c18fc90ef687138565.exe	30
PID 2788 wrote to memory of 2804	2788	00fc888ab2a6a6c18fc90ef687138565.exe	30
PID 2788 wrote to memory of 2804	2788	00fc888ab2a6a6c18fc90ef687138565.exe	30
PID 2788 wrote to memory of 2804	2788	00fc888ab2a6a6c18fc90ef687138565.exe	30
PID 2788 wrote to memory of 2804	2788	00fc888ab2a6a6c18fc90ef687138565.exe	30

C:\Users\Admin\AppData\Local\Temp\00fc888ab2a6a6c18fc90ef687138565.exe
"C:\Users\Admin\AppData\Local\Temp\00fc888ab2a6a6c18fc90ef687138565.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 268
  2⤵
  - Program crash
  PID:2804

memory/2788-0-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/2788-2-0x00000000004E0000-0x00000000005B7000-memory.dmp

Filesize
860KB

Download
memory/2788-3-0x00000000004E0000-0x00000000005B7000-memory.dmp

Filesize
860KB

Download
memory/2788-4-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download