1b5b8f227f6024747259ba3cb483f42d1133f62df3dc480d4f4bed73eb675129

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 23:40

Target

43dc84c9421dab6dc1be64e627b6316a.exe
Size

430KB
MD5

43dc84c9421dab6dc1be64e627b6316a
SHA1

cae31c51b7dd1a1f7329b01050f62caf08a704b1
SHA256

1b5b8f227f6024747259ba3cb483f42d1133f62df3dc480d4f4bed73eb675129
SHA512

d4a49801fa14341068b2faf3fea12be0d8110517af77fe1e315042787d8ed80c03993b7c71d379055a59220e5b7c5140b53a06ee384257ab0407d23fc512e6c4
SSDEEP

6144:Ulsy4TNbEm1B1zzqaCh9Ju/2x+vw0b8ajNglS2+gUXpP9YC4r:UdwNIm1B1zzqrh9Jf+btwSfgUnBI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2188	2240	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2188	2240	43dc84c9421dab6dc1be64e627b6316a.exe	16
PID 2240 wrote to memory of 2188	2240	43dc84c9421dab6dc1be64e627b6316a.exe	16
PID 2240 wrote to memory of 2188	2240	43dc84c9421dab6dc1be64e627b6316a.exe	16
PID 2240 wrote to memory of 2188	2240	43dc84c9421dab6dc1be64e627b6316a.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 116
1⤵
- Program crash
PID:2188

C:\Users\Admin\AppData\Local\Temp\43dc84c9421dab6dc1be64e627b6316a.exe
"C:\Users\Admin\AppData\Local\Temp\43dc84c9421dab6dc1be64e627b6316a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2240

memory/2240-0-0x0000000000A10000-0x0000000000A80000-memory.dmp

Filesize
448KB

Download