b4bf300d373bedbfc71c7b62a0544a9fe56225d999777241b0e465ebaf612e04

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:01

Target

018b345e23f612195bb1bf413e42135f.exe
Size

55KB
MD5

018b345e23f612195bb1bf413e42135f
SHA1

cbac0a8f77eeebb6a0d04279aac726f15007975b
SHA256

b4bf300d373bedbfc71c7b62a0544a9fe56225d999777241b0e465ebaf612e04
SHA512

b452b53b994058eda9c3d9e603950e1cb0c07ab850d0cd3c1cce7398c674a6925f2d703f255b42bde26e2f492a411ba1d83ea76f4e59e58cd391d1f34c2b5240
SSDEEP

768:94/s89Op5PXtjGmNjIbqkVjnSWoh+dE66UyxXRAHKJY3ZsYqzqMqf/1H5rqXdnhK:94CP1FkJSWMgE66ZxhdasYtvlxw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2328	2752	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2328	2752	018b345e23f612195bb1bf413e42135f.exe	28
PID 2752 wrote to memory of 2328	2752	018b345e23f612195bb1bf413e42135f.exe	28
PID 2752 wrote to memory of 2328	2752	018b345e23f612195bb1bf413e42135f.exe	28
PID 2752 wrote to memory of 2328	2752	018b345e23f612195bb1bf413e42135f.exe	28

C:\Users\Admin\AppData\Local\Temp\018b345e23f612195bb1bf413e42135f.exe
"C:\Users\Admin\AppData\Local\Temp\018b345e23f612195bb1bf413e42135f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 140
  2⤵
  - Program crash
  PID:2328

memory/2752-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2752-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download