26b380143748af22892c8aada218e7cd6930f8b4956c7ddbae3ee0502f143184

Analysis

max time kernel
120s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 21:56

Target

3e9284ef308e2d99b1596f10eb78d736.exe
Size

1.1MB
MD5

3e9284ef308e2d99b1596f10eb78d736
SHA1

8fa9227a8d9779cf62ab8ab57d764297ec770302
SHA256

26b380143748af22892c8aada218e7cd6930f8b4956c7ddbae3ee0502f143184
SHA512

fa8451bf134546d458e8a1ae339825d9b91c436ca8bb2b4c7198f25094feee9dd9b23f3deeee3cdda68d707b93e0ad30820f3654381ed7f168ee90bc31fb6100
SSDEEP

12288:oN5fsnLuxmuKt0VMcBrcb9NUPxXj7AGYv2m3YFXRrSF4zkarOuIHk:E5fdxY0ac6NUP5lYNQX1hvOuIH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1996	2044	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1996	2044	3e9284ef308e2d99b1596f10eb78d736.exe	28
PID 2044 wrote to memory of 1996	2044	3e9284ef308e2d99b1596f10eb78d736.exe	28
PID 2044 wrote to memory of 1996	2044	3e9284ef308e2d99b1596f10eb78d736.exe	28
PID 2044 wrote to memory of 1996	2044	3e9284ef308e2d99b1596f10eb78d736.exe	28

C:\Users\Admin\AppData\Local\Temp\3e9284ef308e2d99b1596f10eb78d736.exe
"C:\Users\Admin\AppData\Local\Temp\3e9284ef308e2d99b1596f10eb78d736.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 88
  2⤵
  - Program crash
  PID:1996

memory/2044-0-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download