bdcf903ee0d58621ebf895f586ba367427dadfe45b8f5e830c9c4249ae386d3f

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 22:05

Target

3ef43310764e9f4a7f06c7f69f796904.exe
Size

35KB
MD5

3ef43310764e9f4a7f06c7f69f796904
SHA1

22aabb99db336c76379cc9aadbb483dfb8dae5ba
SHA256

bdcf903ee0d58621ebf895f586ba367427dadfe45b8f5e830c9c4249ae386d3f
SHA512

5164cc33324419d971c768f33d340420149272b288c9a15ff2e48dba958a5928f9e762fc510a8041ea9fe1ba07a15603e000c41fc21e1107309c1acd3265f584
SSDEEP

768:1YBT9rVGHFD0LrPxLNf/P/torqol0oK4z1r2Cj8cr24A:1Y9qA5Nf/NFoC14z1rN4cyR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2072	2092	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2072	2092	3ef43310764e9f4a7f06c7f69f796904.exe	28
PID 2092 wrote to memory of 2072	2092	3ef43310764e9f4a7f06c7f69f796904.exe	28
PID 2092 wrote to memory of 2072	2092	3ef43310764e9f4a7f06c7f69f796904.exe	28
PID 2092 wrote to memory of 2072	2092	3ef43310764e9f4a7f06c7f69f796904.exe	28

C:\Users\Admin\AppData\Local\Temp\3ef43310764e9f4a7f06c7f69f796904.exe
"C:\Users\Admin\AppData\Local\Temp\3ef43310764e9f4a7f06c7f69f796904.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 88
  2⤵
  - Program crash
  PID:2072

memory/2092-0-0x0000000013140000-0x0000000013186000-memory.dmp

Filesize
280KB

Download
memory/2092-1-0x0000000013140000-0x0000000013186000-memory.dmp

Filesize
280KB

Download