7f88ec4989042ee93727cfee3d8c600aa8a21c5f79ccf0dbcedbf4ea9963a9a9

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 22:53

Target

418bc5a404d7d3bb08a3ca354864dc69.exe
Size

45KB
MD5

418bc5a404d7d3bb08a3ca354864dc69
SHA1

f42e551fa00cd883874ced3d3ca371bcc9900142
SHA256

7f88ec4989042ee93727cfee3d8c600aa8a21c5f79ccf0dbcedbf4ea9963a9a9
SHA512

44583f7df58b74586fd3aeb9c2c0ec21ab5bea19ef0ccf7d85bdac9cc6995e6471288bb5dec08033c25fa956659c106ecc01ebf64333f7d580405039719b047a
SSDEEP

768:i2peaIW2JIA7gQjtvjDD0wrNH2rakj37GyNQOCyedynTpkRNiY/1H5H:i7aIW2JIA7gQjZrpEDQ5opkRNie9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2516	1212	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 2516	1212	418bc5a404d7d3bb08a3ca354864dc69.exe	13
PID 1212 wrote to memory of 2516	1212	418bc5a404d7d3bb08a3ca354864dc69.exe	13
PID 1212 wrote to memory of 2516	1212	418bc5a404d7d3bb08a3ca354864dc69.exe	13
PID 1212 wrote to memory of 2516	1212	418bc5a404d7d3bb08a3ca354864dc69.exe	13

C:\Users\Admin\AppData\Local\Temp\418bc5a404d7d3bb08a3ca354864dc69.exe
"C:\Users\Admin\AppData\Local\Temp\418bc5a404d7d3bb08a3ca354864dc69.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 140
  2⤵
  - Program crash
  PID:2516

memory/1212-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1212-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download