21ecd5f1953d23e03ca8bfc688b848d2ad7bfc4f4505fed94020cc439f3ff18d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 18:06

Target

0a87ba0308107887fe3c0d5fe2bd0971.exe
Size

106KB
MD5

0a87ba0308107887fe3c0d5fe2bd0971
SHA1

343079e2a30cd00d082afc820e74d46f2759d28e
SHA256

21ecd5f1953d23e03ca8bfc688b848d2ad7bfc4f4505fed94020cc439f3ff18d
SHA512

3f58a5b3cb44506ed1aa9e58fad374c88aa8db5a920250e657ddf53a53892297818ea4c3e876ba92daf9729285a23daef0c1bdc1e7ae007b629bdbed7a934778
SSDEEP

1536:8+FDoKtniY1u7Nn2JFkC2styJjCKICFjC7EWisS+5mlatSfkZ:8+FDzK71QkbstyJjCKICpC72s/mlaX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
1720	1936	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1720	1936	0a87ba0308107887fe3c0d5fe2bd0971.exe	14
PID 1936 wrote to memory of 1720	1936	0a87ba0308107887fe3c0d5fe2bd0971.exe	14
PID 1936 wrote to memory of 1720	1936	0a87ba0308107887fe3c0d5fe2bd0971.exe	14
PID 1936 wrote to memory of 1720	1936	0a87ba0308107887fe3c0d5fe2bd0971.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 124
1⤵
- Program crash
PID:1720

C:\Users\Admin\AppData\Local\Temp\0a87ba0308107887fe3c0d5fe2bd0971.exe
"C:\Users\Admin\AppData\Local\Temp\0a87ba0308107887fe3c0d5fe2bd0971.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936

memory/1936-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download