bdde831dea6f3b6d5c1a34e7d18306d7feed666dcf50a14ce727b970163175f5

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 00:19

Target

1c6345aa3efd7ea012ac7f9be52f1569.exe
Size

8KB
MD5

1c6345aa3efd7ea012ac7f9be52f1569
SHA1

a0a07e370fc53b649ca8e9ddd3521d6c046773d8
SHA256

bdde831dea6f3b6d5c1a34e7d18306d7feed666dcf50a14ce727b970163175f5
SHA512

a3f8fd8e86bc012965a356ae491abe00a8ef98851dbca0a396ab7b191972e2322202baba3df3857cb5404f8b4a5c89f5efda3d5267acf55a026067f09b62dedb
SSDEEP

48:OEPxQovclICkfGOLgdpVmSUQlXMjM8O/2fb/ayAH3PvhIB6pT:nP2ovclqGOcdpMacj5O/weycvuQpT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2500	1192	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 2500	1192	1c6345aa3efd7ea012ac7f9be52f1569.exe	14
PID 1192 wrote to memory of 2500	1192	1c6345aa3efd7ea012ac7f9be52f1569.exe	14
PID 1192 wrote to memory of 2500	1192	1c6345aa3efd7ea012ac7f9be52f1569.exe	14
PID 1192 wrote to memory of 2500	1192	1c6345aa3efd7ea012ac7f9be52f1569.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 36
1⤵
- Program crash
PID:2500

C:\Users\Admin\AppData\Local\Temp\1c6345aa3efd7ea012ac7f9be52f1569.exe
"C:\Users\Admin\AppData\Local\Temp\1c6345aa3efd7ea012ac7f9be52f1569.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1192

memory/1192-0-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download