bdc35cf7b939fac4d3a67f9902c9af6f2d8b33b9cd45dc73581f79b76227888e

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:42

Target

11a2b4de6bcec6a08d9b2bd008fd1a3e.exe
Size

266KB
MD5

11a2b4de6bcec6a08d9b2bd008fd1a3e
SHA1

443c56a2a828976b892801c0bd52878de3ba685c
SHA256

bdc35cf7b939fac4d3a67f9902c9af6f2d8b33b9cd45dc73581f79b76227888e
SHA512

f589af3e06ded50cc85c5a0bc86d17c72651e8f477ff7390c85f0f29acdb9ec913c23115d3c72d03c1885ccad662acc58f3780c7e6c3c93cc75fd743df886a4d
SSDEEP

6144:4R/N5N573uw4Y1K7P4bU8wViPO/LQTh2p5gP2XQ2beK:4nJN48Kb4UVi2/Ed2jq2Db

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2088	2036	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2088	2036	11a2b4de6bcec6a08d9b2bd008fd1a3e.exe	28
PID 2036 wrote to memory of 2088	2036	11a2b4de6bcec6a08d9b2bd008fd1a3e.exe	28
PID 2036 wrote to memory of 2088	2036	11a2b4de6bcec6a08d9b2bd008fd1a3e.exe	28
PID 2036 wrote to memory of 2088	2036	11a2b4de6bcec6a08d9b2bd008fd1a3e.exe	28

C:\Users\Admin\AppData\Local\Temp\11a2b4de6bcec6a08d9b2bd008fd1a3e.exe
"C:\Users\Admin\AppData\Local\Temp\11a2b4de6bcec6a08d9b2bd008fd1a3e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 36
  2⤵
  - Program crash
  PID:2088

memory/2036-0-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download