7de99828f82e6e594f101fe136dca8c17357fbdbf3191d982283ba825411a80c

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 19:19

Target

0ce846d2773d168c9dec9fb2655ef257.exe
Size

223KB
MD5

0ce846d2773d168c9dec9fb2655ef257
SHA1

06fb90646dae785d8a09fecd9ebe5965469e00b7
SHA256

7de99828f82e6e594f101fe136dca8c17357fbdbf3191d982283ba825411a80c
SHA512

ef822ede90c159ba7935b13e60f7b39681b991fa4eac4b92df2809b2182fc095c6d72d0bff1ee206b73392a21f2babc8d2ec4a96bdc06c47e385fbad643e8f1c
SSDEEP

3072:FOSqJTW96sH+WXWgN/luZtIMvOpzAjRQ1mOLiFNo5uJR1cVZuVj+/h9UhF7LrVqD:Fo63DQIMGpGQQFNQSuVZ0j+/7UbLrQe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2760	2600	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2760	2600	0ce846d2773d168c9dec9fb2655ef257.exe	28
PID 2600 wrote to memory of 2760	2600	0ce846d2773d168c9dec9fb2655ef257.exe	28
PID 2600 wrote to memory of 2760	2600	0ce846d2773d168c9dec9fb2655ef257.exe	28
PID 2600 wrote to memory of 2760	2600	0ce846d2773d168c9dec9fb2655ef257.exe	28

C:\Users\Admin\AppData\Local\Temp\0ce846d2773d168c9dec9fb2655ef257.exe
"C:\Users\Admin\AppData\Local\Temp\0ce846d2773d168c9dec9fb2655ef257.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 88
  2⤵
  - Program crash
  PID:2760