7976838a64285cc0e9f8a77c7c1dc36803239d2aa8c5eea80833421657216321

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 00:27

Target

1ce6bc74a867c2f2d0bb442c8b933888.exe
Size

101KB
MD5

1ce6bc74a867c2f2d0bb442c8b933888
SHA1

49d14dfb3a6f6038a40b027609b7954f1107cec6
SHA256

7976838a64285cc0e9f8a77c7c1dc36803239d2aa8c5eea80833421657216321
SHA512

4308cce7827901cd17d67068bec21079e926ca0fb450b2fdbcd280eb38b543ab2396a061f3a76bee29571e1d3709b8dab70247b4bd6a7d97b68ba284becc0195
SSDEEP

1536:jQkVjEGb1BSrvnPeYJo9Vu3sQwsanTdgW/OQ/s1x3UM0+efcpsmC:MkVD1BSqao9c3HwsanTdgyOxsP+f+b

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2252	1772	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 2252	1772	1ce6bc74a867c2f2d0bb442c8b933888.exe	16
PID 1772 wrote to memory of 2252	1772	1ce6bc74a867c2f2d0bb442c8b933888.exe	16
PID 1772 wrote to memory of 2252	1772	1ce6bc74a867c2f2d0bb442c8b933888.exe	16
PID 1772 wrote to memory of 2252	1772	1ce6bc74a867c2f2d0bb442c8b933888.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 92
1⤵
- Program crash
PID:2252

C:\Users\Admin\AppData\Local\Temp\1ce6bc74a867c2f2d0bb442c8b933888.exe
"C:\Users\Admin\AppData\Local\Temp\1ce6bc74a867c2f2d0bb442c8b933888.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1772

memory/1772-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download