c61366d76f7299e0e8748d0aaea8a60091025512191216630eb23224e6071cfb

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 19:50

Target

0ee0b3df5e8f30497e37ee79e33eaad4.exe
Size

39KB
MD5

0ee0b3df5e8f30497e37ee79e33eaad4
SHA1

d1094d7062f5f5b0e95fe9ae9a15c4b830a54d51
SHA256

c61366d76f7299e0e8748d0aaea8a60091025512191216630eb23224e6071cfb
SHA512

c0e57c20f9903eef738a9b4f4cde6f62acc35b645ae5cf27a466c8349a2caeb9f65ea06a523a61c93cebb38e59fb10250faed91b6d327f45b736d89704f4d2cc
SSDEEP

768:dzuym+bEPemnt1Gocbmt0YXyjB+cD3aREy/jAiWKREy/jAiW:dzJbEztgoemthY+c7a2mjAiWK2mjAiW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2276	2100	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2276	2100	0ee0b3df5e8f30497e37ee79e33eaad4.exe	28
PID 2100 wrote to memory of 2276	2100	0ee0b3df5e8f30497e37ee79e33eaad4.exe	28
PID 2100 wrote to memory of 2276	2100	0ee0b3df5e8f30497e37ee79e33eaad4.exe	28
PID 2100 wrote to memory of 2276	2100	0ee0b3df5e8f30497e37ee79e33eaad4.exe	28

C:\Users\Admin\AppData\Local\Temp\0ee0b3df5e8f30497e37ee79e33eaad4.exe
"C:\Users\Admin\AppData\Local\Temp\0ee0b3df5e8f30497e37ee79e33eaad4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 88
  2⤵
  - Program crash
  PID:2276