93842b6d8eaf4be6e428995d11b8d486938fcae6896bfb5a8c6056836c356eab

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 19:21

Target

0d0982f8ab06d03fec0b5627174fa03f.exe
Size

64KB
MD5

0d0982f8ab06d03fec0b5627174fa03f
SHA1

d22a4e42dab4c01304520961e5534cb713019d4d
SHA256

93842b6d8eaf4be6e428995d11b8d486938fcae6896bfb5a8c6056836c356eab
SHA512

d3c1a1ba4cd0f9f89d77e1b01e2b1fa7d31d5d2db6b4c4a070722299ebb6f8c5bbb154784c342f07533c990b88938f88c818c5d11a028c30e777b0b6e1b0c534
SSDEEP

1536:oWGMQdVRo4zCHOPnTqMgVuVL9YMLXQ2LstsBMu/H1:oWGxdw4zCWnTqMgAl9YMlMaN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1280	2928	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 1280	2928	0d0982f8ab06d03fec0b5627174fa03f.exe	28
PID 2928 wrote to memory of 1280	2928	0d0982f8ab06d03fec0b5627174fa03f.exe	28
PID 2928 wrote to memory of 1280	2928	0d0982f8ab06d03fec0b5627174fa03f.exe	28
PID 2928 wrote to memory of 1280	2928	0d0982f8ab06d03fec0b5627174fa03f.exe	28

C:\Users\Admin\AppData\Local\Temp\0d0982f8ab06d03fec0b5627174fa03f.exe
"C:\Users\Admin\AppData\Local\Temp\0d0982f8ab06d03fec0b5627174fa03f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 140
  2⤵
  - Program crash
  PID:1280

memory/2928-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download