2f0bdc0e612c88a97c382be94d868b5d222dbc6ad269d8f82f43e88bd58cda01

Analysis

max time kernel
119s
max time network
157s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 23:22

Target

42ec155a291f7c99207b2a849fb8785a.exe
Size

368KB
MD5

42ec155a291f7c99207b2a849fb8785a
SHA1

9bb96055e1f87de51114b24d8cb268cab2ce5c09
SHA256

2f0bdc0e612c88a97c382be94d868b5d222dbc6ad269d8f82f43e88bd58cda01
SHA512

3f2d9e80fa3c09ee108c84eb45dcf763559ef53a1928cf32c2fc68ea519199cc63205aa563df7e955a15a034e8a1bb3641c649c54c1b400e671f062632db5ad7
SSDEEP

6144:RTAp4naqm5GR/0N4Ftn6vicI8qtQQenKDFujBeqSDgzB8jk34:R041m5Q/0N4L9xYus1NSD2Cg34

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2068	2568	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2068	2568	42ec155a291f7c99207b2a849fb8785a.exe	29
PID 2568 wrote to memory of 2068	2568	42ec155a291f7c99207b2a849fb8785a.exe	29
PID 2568 wrote to memory of 2068	2568	42ec155a291f7c99207b2a849fb8785a.exe	29
PID 2568 wrote to memory of 2068	2568	42ec155a291f7c99207b2a849fb8785a.exe	29

C:\Users\Admin\AppData\Local\Temp\42ec155a291f7c99207b2a849fb8785a.exe
"C:\Users\Admin\AppData\Local\Temp\42ec155a291f7c99207b2a849fb8785a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 116
  2⤵
  - Program crash
  PID:2068

memory/2568-0-0x0000000000FE0000-0x0000000001040000-memory.dmp

Filesize
384KB

Download