cb8f403a7f6e9b3ba751b8d08d209ac8a39e7eeaff447367a7c271733bde8d20

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 15:19

Target

0372627d1d7f048b345c18c550a41e63.exe
Size

644KB
MD5

0372627d1d7f048b345c18c550a41e63
SHA1

4be693df6a856e73f106536a4bf27f0b3a16737e
SHA256

cb8f403a7f6e9b3ba751b8d08d209ac8a39e7eeaff447367a7c271733bde8d20
SHA512

d730323a7490b5ae8709cac7bb13ce46e4af95662caafa2fe3bac0e631deb2ee4df57cf92fe13144a0a3cf3437f0ab0af37f86383c9d66bf8d116f3c58d8b1f9
SSDEEP

12288:ri6U0BFtvsPUkGXgDkmBxAJmKVg8zThh6XQ1HoOUAWfTq3N:TVXtyLGwDJkJxVVzXIIHokWfTq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1372	1464	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1372	1464	0372627d1d7f048b345c18c550a41e63.exe	16
PID 1464 wrote to memory of 1372	1464	0372627d1d7f048b345c18c550a41e63.exe	16
PID 1464 wrote to memory of 1372	1464	0372627d1d7f048b345c18c550a41e63.exe	16
PID 1464 wrote to memory of 1372	1464	0372627d1d7f048b345c18c550a41e63.exe	16

C:\Users\Admin\AppData\Local\Temp\0372627d1d7f048b345c18c550a41e63.exe
"C:\Users\Admin\AppData\Local\Temp\0372627d1d7f048b345c18c550a41e63.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 124
  2⤵
  - Program crash
  PID:1372

memory/1464-0-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/1464-1-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download