eaea6bf5e56a4dcc0ed15e6911ef9b70bcb37f7e0001618074a60faddf9ed10d

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 23:48

Target

443f6f1c46dde45639932d34faf6cb95.exe
Size

76KB
MD5

443f6f1c46dde45639932d34faf6cb95
SHA1

a7bbc6e2ba72d5bad5a5447ac25d1f29c7275194
SHA256

eaea6bf5e56a4dcc0ed15e6911ef9b70bcb37f7e0001618074a60faddf9ed10d
SHA512

2e1ef94cb1df9c108ed8f9fffa527363bf67b613cacfe20a8708b91d3e6d3a21ae3c36597cfaec88ec3298baf975618edf024e5f9573d152eb4f6ca0b15fd152
SSDEEP

1536:S/ePyXHZ7DA4BfBrmTiXvvvUgbFNCuACP1DIgN:4eSHZ7DTBfBrB/UgbFNCuAq2C

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2756	2532	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2756	2532	443f6f1c46dde45639932d34faf6cb95.exe	28
PID 2532 wrote to memory of 2756	2532	443f6f1c46dde45639932d34faf6cb95.exe	28
PID 2532 wrote to memory of 2756	2532	443f6f1c46dde45639932d34faf6cb95.exe	28
PID 2532 wrote to memory of 2756	2532	443f6f1c46dde45639932d34faf6cb95.exe	28

C:\Users\Admin\AppData\Local\Temp\443f6f1c46dde45639932d34faf6cb95.exe
"C:\Users\Admin\AppData\Local\Temp\443f6f1c46dde45639932d34faf6cb95.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 108
  2⤵
  - Program crash
  PID:2756

memory/2532-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2532-1-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download