f3e1d55abd63c96a242c84c71a8aa16f11a88d584708b99f93600212a0174200

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:10

Target

0210eb5a2b7a5ea47f98d461f3d049fc.exe
Size

321KB
MD5

0210eb5a2b7a5ea47f98d461f3d049fc
SHA1

af22325a1be99086eafad844b5660f36340c9fa4
SHA256

f3e1d55abd63c96a242c84c71a8aa16f11a88d584708b99f93600212a0174200
SHA512

03919a98736e2235393e40971d85366eafa9038d5cc50d09469715d921b8347a7d68883ab32b7c6990a0618274d88041ad6c83d0aa361a25891450c278f10899
SSDEEP

6144:OTj1OTEKnsub1upoH7td/tQqG56Prd3Z5NBA3r14lJDNIl:OFOoKnsub6oHprG5+3a7STY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2200	2204	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2200	2204	0210eb5a2b7a5ea47f98d461f3d049fc.exe	14
PID 2204 wrote to memory of 2200	2204	0210eb5a2b7a5ea47f98d461f3d049fc.exe	14
PID 2204 wrote to memory of 2200	2204	0210eb5a2b7a5ea47f98d461f3d049fc.exe	14
PID 2204 wrote to memory of 2200	2204	0210eb5a2b7a5ea47f98d461f3d049fc.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 116
1⤵
- Program crash
PID:2200

C:\Users\Admin\AppData\Local\Temp\0210eb5a2b7a5ea47f98d461f3d049fc.exe
"C:\Users\Admin\AppData\Local\Temp\0210eb5a2b7a5ea47f98d461f3d049fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2204

memory/2204-0-0x0000000000D90000-0x0000000000DE5000-memory.dmp

Filesize
340KB

Download