12ee48abb2bbda7d4e189b5ebd849a13bd66e1215d8c7c4b034555e7afa32a00

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 17:25

Target

086a77278c94719fd07a83d6b31c4961.exe
Size

55KB
MD5

086a77278c94719fd07a83d6b31c4961
SHA1

1f58e5689537bbf2dda87685c1ad884bf43f6626
SHA256

12ee48abb2bbda7d4e189b5ebd849a13bd66e1215d8c7c4b034555e7afa32a00
SHA512

314184abe17c34d44231e63f0ef16090efc687a85bd63a008085f016c9d34e827ae7990991bc3f23f51dc9c2616ad0a12af4ef6c17feec0553e5a0592aa8a3b3
SSDEEP

1536:NQ56/eLLlTp/mGLfK+P/Rrh0anLF4vqUtrq+CbVj/kI7voN3NVNFcRbsENDYEQ24:NsnFK4VJ5q0G

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1960	356	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 356 wrote to memory of 1960	356	086a77278c94719fd07a83d6b31c4961.exe	28
PID 356 wrote to memory of 1960	356	086a77278c94719fd07a83d6b31c4961.exe	28
PID 356 wrote to memory of 1960	356	086a77278c94719fd07a83d6b31c4961.exe	28
PID 356 wrote to memory of 1960	356	086a77278c94719fd07a83d6b31c4961.exe	28

C:\Users\Admin\AppData\Local\Temp\086a77278c94719fd07a83d6b31c4961.exe
"C:\Users\Admin\AppData\Local\Temp\086a77278c94719fd07a83d6b31c4961.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 356 -s 308
  2⤵
  - Program crash
  PID:1960

memory/356-0-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download