c1800ceb3e41d9c5a217d6ac38650fab49d82534866b82210738f9655173cc4d

Analysis

max time kernel
122s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 01:19

Target

1ffb1897abe07c8b450dab3f12ca8b88.exe
Size

236KB
MD5

1ffb1897abe07c8b450dab3f12ca8b88
SHA1

6fc721df8bba3fd1f656c049666511d3ec2d90a6
SHA256

c1800ceb3e41d9c5a217d6ac38650fab49d82534866b82210738f9655173cc4d
SHA512

f35cb7ce1488d0192ba0c579840fecb132f3660c1031bfa73b014083f1a3159cf9c3d992288312d10d89774f398a9dc65101de314728d07a15108a7bfe9e6b86
SSDEEP

6144:bLPAjWbiq46Wq/In5SdHp7FW7NFzz118osdq1Um6xsnPFj:bAaiq46Wd56VAB1TPdj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3044	2860	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 3044	2860	1ffb1897abe07c8b450dab3f12ca8b88.exe	27
PID 2860 wrote to memory of 3044	2860	1ffb1897abe07c8b450dab3f12ca8b88.exe	27
PID 2860 wrote to memory of 3044	2860	1ffb1897abe07c8b450dab3f12ca8b88.exe	27
PID 2860 wrote to memory of 3044	2860	1ffb1897abe07c8b450dab3f12ca8b88.exe	27

C:\Users\Admin\AppData\Local\Temp\1ffb1897abe07c8b450dab3f12ca8b88.exe
"C:\Users\Admin\AppData\Local\Temp\1ffb1897abe07c8b450dab3f12ca8b88.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 36
  2⤵
  - Program crash
  PID:3044

memory/2860-0-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download