916e3b6a2655cdeea10691024bbc406355ec1a137708df5c595a119654cdd623

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:55

Target

12266bb15f1ba5ac8e8df42608ce4bd1.exe
Size

102KB
MD5

12266bb15f1ba5ac8e8df42608ce4bd1
SHA1

655519890f6db4c8faaf01b870ad1c5cf0c8c6cc
SHA256

916e3b6a2655cdeea10691024bbc406355ec1a137708df5c595a119654cdd623
SHA512

740216ef2ceda5d9910dc34f2af695149d1a7b93f2c2d7c670f84fa4ded59c4edde8c91ed82d9ed59000b8b1ad1493ed65de40d1b3ff6dd0266c99b366149941
SSDEEP

1536:aS9km6KZ8ZAxB6IY1u2uuCeiMTEcGTsI/QDzNx62wlf0jfgTR1H:mmz8ZuB6JYqX7VA/w62wVnTR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	2004	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2012	2004	12266bb15f1ba5ac8e8df42608ce4bd1.exe	28
PID 2004 wrote to memory of 2012	2004	12266bb15f1ba5ac8e8df42608ce4bd1.exe	28
PID 2004 wrote to memory of 2012	2004	12266bb15f1ba5ac8e8df42608ce4bd1.exe	28
PID 2004 wrote to memory of 2012	2004	12266bb15f1ba5ac8e8df42608ce4bd1.exe	28

C:\Users\Admin\AppData\Local\Temp\12266bb15f1ba5ac8e8df42608ce4bd1.exe
"C:\Users\Admin\AppData\Local\Temp\12266bb15f1ba5ac8e8df42608ce4bd1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 168
  2⤵
  - Program crash
  PID:2012

memory/2004-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download