8ac6455206f4c10b4a6cb9193704b988d42e07a835cb471601eba2e2a6c0fd19

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 19:33

Target

0dc9c7c17d68f01e69d39e92b0a4becf.exe
Size

18KB
MD5

0dc9c7c17d68f01e69d39e92b0a4becf
SHA1

fe597ab996c6bf74cbddcd5bfa67f57b391bd0fe
SHA256

8ac6455206f4c10b4a6cb9193704b988d42e07a835cb471601eba2e2a6c0fd19
SHA512

c46f6dbbbd93de0bb72e093eea21671280728526756490916b5a5da2909516fb0e83d5e83c25570e07b664eeedc567759bedf6cb218a66fa067be2a051dad3ca
SSDEEP

96:pygmKZ+sxdrJomjaXCG8m8DSw0ASsYTXUqRkAL:pygmKZTdrJcXCG8m8WwtSsskAkA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2676	2212	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2676	2212	0dc9c7c17d68f01e69d39e92b0a4becf.exe	28
PID 2212 wrote to memory of 2676	2212	0dc9c7c17d68f01e69d39e92b0a4becf.exe	28
PID 2212 wrote to memory of 2676	2212	0dc9c7c17d68f01e69d39e92b0a4becf.exe	28
PID 2212 wrote to memory of 2676	2212	0dc9c7c17d68f01e69d39e92b0a4becf.exe	28

C:\Users\Admin\AppData\Local\Temp\0dc9c7c17d68f01e69d39e92b0a4becf.exe
"C:\Users\Admin\AppData\Local\Temp\0dc9c7c17d68f01e69d39e92b0a4becf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 188
  2⤵
  - Program crash
  PID:2676