9ef799d3ac148d4cec03c11be997bef79e4307d87c39e386d65389d178514928

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 02:57

Target

01610a956c23301de35ab97666658368.exe
Size

112KB
MD5

01610a956c23301de35ab97666658368
SHA1

75152c7830156a15100e37e32f31299a20f02f86
SHA256

9ef799d3ac148d4cec03c11be997bef79e4307d87c39e386d65389d178514928
SHA512

bd1bcdb2b639d65f611f41d1ce328e553991b0df549a31a7fc38041de10141a809f5d265b61a7b2920c0d8580612a12b31e5ca304537eecb9bca206cc7cb1076
SSDEEP

48:ye138Ax0mjBXwStADqWKAoglmwbTpFk1hqiSnt46ZV62AyOXohacsw2tvhBMCKVg:HNZBPZWKAoOmaTpFuhLYOFG04U

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1936	1712	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1936	1712	01610a956c23301de35ab97666658368.exe	28
PID 1712 wrote to memory of 1936	1712	01610a956c23301de35ab97666658368.exe	28
PID 1712 wrote to memory of 1936	1712	01610a956c23301de35ab97666658368.exe	28
PID 1712 wrote to memory of 1936	1712	01610a956c23301de35ab97666658368.exe	28

C:\Users\Admin\AppData\Local\Temp\01610a956c23301de35ab97666658368.exe
"C:\Users\Admin\AppData\Local\Temp\01610a956c23301de35ab97666658368.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 36
  2⤵
  - Program crash
  PID:1936