141e20ef8d52b0be921ae6649c4cc85dc5ca3e9c180aea2dd7d1f405c15f928f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 17:58

Target

0a09be38631cca6be7254930d617d6f4.exe
Size

575KB
MD5

0a09be38631cca6be7254930d617d6f4
SHA1

17e4bd82c6629f4263b9fe20b19bab891bf3ab10
SHA256

141e20ef8d52b0be921ae6649c4cc85dc5ca3e9c180aea2dd7d1f405c15f928f
SHA512

56735f5e658caabff7e6e9f8985833876993371dbb66c37a50a201dd0437198f4dbddaa27775f711705eada4aeb043dd3a457f654cbde4ec212a9ca2d389537e
SSDEEP

6144:HM65y2N2TjXe9LIhaG8XcCBufpheCzqzaD9whp8aegMPXNI2H9UEY7W9fKb5nNa4:5UjXexIharXNwQCIwwhWBFtiEYfnNK3G

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2392	2304	WerFault.exe	9

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2392	2304	0a09be38631cca6be7254930d617d6f4.exe	28
PID 2304 wrote to memory of 2392	2304	0a09be38631cca6be7254930d617d6f4.exe	28
PID 2304 wrote to memory of 2392	2304	0a09be38631cca6be7254930d617d6f4.exe	28
PID 2304 wrote to memory of 2392	2304	0a09be38631cca6be7254930d617d6f4.exe	28

C:\Users\Admin\AppData\Local\Temp\0a09be38631cca6be7254930d617d6f4.exe
"C:\Users\Admin\AppData\Local\Temp\0a09be38631cca6be7254930d617d6f4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 144
  2⤵
  - Program crash
  PID:2392

memory/2304-0-0x0000000000AD0000-0x0000000000B37000-memory.dmp

Filesize
412KB

Download
memory/2304-1-0x0000000000AD0000-0x0000000000B37000-memory.dmp

Filesize
412KB

Download