e4ca326dd6652d598e8bc07a39e4eb77d2ef428ddcbcfe672807f7d4f05b42cb

Analysis

max time kernel
142s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 00:16

Target

1c3f1073aad6e91ff2cebb78e3c44c62.exe
Size

76KB
MD5

1c3f1073aad6e91ff2cebb78e3c44c62
SHA1

782c8cf148272422f69e565a1d1a8621a2cb4688
SHA256

e4ca326dd6652d598e8bc07a39e4eb77d2ef428ddcbcfe672807f7d4f05b42cb
SHA512

c683e6ab2afa19d717ceae5ec0befd2ad58004fe34459c114e6998695a064a66e738711d64c157c713daaa7a8f6b13d7fe048a98a01a51abe5a63ddfb6b9f185
SSDEEP

1536:+/ePyXHZ7DA4BfBrmTiXvvvUgbFNCuACP1DIgN:8eSHZ7DTBfBrB/UgbFNCuAq2C

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1048	2032	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1048	2032	1c3f1073aad6e91ff2cebb78e3c44c62.exe	28
PID 2032 wrote to memory of 1048	2032	1c3f1073aad6e91ff2cebb78e3c44c62.exe	28
PID 2032 wrote to memory of 1048	2032	1c3f1073aad6e91ff2cebb78e3c44c62.exe	28
PID 2032 wrote to memory of 1048	2032	1c3f1073aad6e91ff2cebb78e3c44c62.exe	28

C:\Users\Admin\AppData\Local\Temp\1c3f1073aad6e91ff2cebb78e3c44c62.exe
"C:\Users\Admin\AppData\Local\Temp\1c3f1073aad6e91ff2cebb78e3c44c62.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 108
  2⤵
  - Program crash
  PID:1048

memory/2032-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2032-1-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download