894acb074f2c224391b7881df7eeb86d03d5f4c441b61419ec9e9dfffe72bfc3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 19:23

Target

0d25dd6ee0b93ca45c9fd98bc9c4e08d.exe
Size

791KB
MD5

0d25dd6ee0b93ca45c9fd98bc9c4e08d
SHA1

b3e22e379fcbf004f87a2787f07ad74105726181
SHA256

894acb074f2c224391b7881df7eeb86d03d5f4c441b61419ec9e9dfffe72bfc3
SHA512

f271e303a6ccb776174e655d370f886b66bf3d85adb14324347acb8cd9c4c1fa1fac8439cdb6441871c134b003c8e936af8f091121a9d279f0e896a4e26fbf78
SSDEEP

12288:vRESnPFroRNGJyjTavgJIRm0CR62QmlNayX50j/N8MESmk87SgBSXBMD17:NFszoyjkoVR/lnX2SMik+uW9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2116	2256	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2116	2256	0d25dd6ee0b93ca45c9fd98bc9c4e08d.exe	16
PID 2256 wrote to memory of 2116	2256	0d25dd6ee0b93ca45c9fd98bc9c4e08d.exe	16
PID 2256 wrote to memory of 2116	2256	0d25dd6ee0b93ca45c9fd98bc9c4e08d.exe	16
PID 2256 wrote to memory of 2116	2256	0d25dd6ee0b93ca45c9fd98bc9c4e08d.exe	16

C:\Users\Admin\AppData\Local\Temp\0d25dd6ee0b93ca45c9fd98bc9c4e08d.exe
"C:\Users\Admin\AppData\Local\Temp\0d25dd6ee0b93ca45c9fd98bc9c4e08d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 148
  2⤵
  - Program crash
  PID:2116

memory/2256-0-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download