235edd32878d227e158c07d4c61b00652b1c091e2ceb3e96a110c5f1cc969a83

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 17:32

Target

08a4ee6eab3015d95e86fef12dea1596.exe
Size

268KB
MD5

08a4ee6eab3015d95e86fef12dea1596
SHA1

a20a2f70de7ec06268cfc669a3c16006a7ebc60d
SHA256

235edd32878d227e158c07d4c61b00652b1c091e2ceb3e96a110c5f1cc969a83
SHA512

e3da81cc40147b65c7e839c4e40540a6cab0dfb760b71cfb260b15a260cfd2e17de3a3e9fa623d73fcc4cb93c8b7458ca008d5b53cdf6a18a8d181ea599b4136
SSDEEP

6144:8wfLAf68fQKgkdiHJZ0LQlvH62vaj5eYeD1eczfrZ8nRXtzy6E:8wfMfBgnHJiLQlC2GA5TrZ8n3W

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
1472	2044	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1472	2044	08a4ee6eab3015d95e86fef12dea1596.exe	14
PID 2044 wrote to memory of 1472	2044	08a4ee6eab3015d95e86fef12dea1596.exe	14
PID 2044 wrote to memory of 1472	2044	08a4ee6eab3015d95e86fef12dea1596.exe	14
PID 2044 wrote to memory of 1472	2044	08a4ee6eab3015d95e86fef12dea1596.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 92
1⤵
- Program crash
PID:1472

C:\Users\Admin\AppData\Local\Temp\08a4ee6eab3015d95e86fef12dea1596.exe
"C:\Users\Admin\AppData\Local\Temp\08a4ee6eab3015d95e86fef12dea1596.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044

memory/2044-0-0x0000000000C80000-0x0000000000C9A000-memory.dmp

Filesize
104KB

Download