6b39276c6d5473429fbf8a9c21c4091726731176b53567c39dd6d89a5c8508bc

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 17:12

Target

07bebd376753885f04d6aff72cf80ddb.exe
Size

329KB
MD5

07bebd376753885f04d6aff72cf80ddb
SHA1

ae7aeb3d701544f1e33aca484c3f603b9a17473a
SHA256

6b39276c6d5473429fbf8a9c21c4091726731176b53567c39dd6d89a5c8508bc
SHA512

9de454c9b32546b531aa8e02fd732e87d0e49df1d8b2131f5c6d057da968eb11a3eec8212e8b06d568437178336c939fe1cd834a0492d3c659157f225f788f7c
SSDEEP

6144:9NNN+EUQbxcveBwSjsluIpT+6Y79SCvRFT5lRr6E8RwNmRR5Iey:9/cQymBwSjsjpT+6ESCvRx5Hr6E8RwNd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2008	368	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 2008	368	07bebd376753885f04d6aff72cf80ddb.exe	28
PID 368 wrote to memory of 2008	368	07bebd376753885f04d6aff72cf80ddb.exe	28
PID 368 wrote to memory of 2008	368	07bebd376753885f04d6aff72cf80ddb.exe	28
PID 368 wrote to memory of 2008	368	07bebd376753885f04d6aff72cf80ddb.exe	28

C:\Users\Admin\AppData\Local\Temp\07bebd376753885f04d6aff72cf80ddb.exe
"C:\Users\Admin\AppData\Local\Temp\07bebd376753885f04d6aff72cf80ddb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 116
  2⤵
  - Program crash
  PID:2008

memory/368-0-0x00000000011E0000-0x0000000001236000-memory.dmp

Filesize
344KB

Download