60330a2235aa5954307d86a062ce110c72338fd3680e87b0991141df2aa7fb7f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 21:05

Target

12522aaadae9f0cec4cc5edd206a0fe5.exe
Size

118KB
MD5

12522aaadae9f0cec4cc5edd206a0fe5
SHA1

28cb90a107579879e5ab3e8a363db348be5f888d
SHA256

60330a2235aa5954307d86a062ce110c72338fd3680e87b0991141df2aa7fb7f
SHA512

83b58eff6ab5f519ad63368adf9ca74634a2b6bb32d1b24ae6a5dbca5607df47465d6636de45cc88c11d0c931aed43936fa0be28fa4c1e524915ce78bc48a0b9
SSDEEP

1536:dbdo6pwas3BEBGviCxaOdHJTLusq/LpqXNWfBPLDFZLlKtrs/oWXZtS:db+uwZx3vij+JdK49WfhhKtA/Lu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
1540	2248	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1540	2248	12522aaadae9f0cec4cc5edd206a0fe5.exe	14
PID 2248 wrote to memory of 1540	2248	12522aaadae9f0cec4cc5edd206a0fe5.exe	14
PID 2248 wrote to memory of 1540	2248	12522aaadae9f0cec4cc5edd206a0fe5.exe	14
PID 2248 wrote to memory of 1540	2248	12522aaadae9f0cec4cc5edd206a0fe5.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 168
1⤵
- Program crash
PID:1540

C:\Users\Admin\AppData\Local\Temp\12522aaadae9f0cec4cc5edd206a0fe5.exe
"C:\Users\Admin\AppData\Local\Temp\12522aaadae9f0cec4cc5edd206a0fe5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2248

memory/2248-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download