f01c0873e828b23464f884d7b97066ce21103203960461704bf699a0a7884bf2

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:56

Target

042f03c2b5971e5996956871d43b98ae.exe
Size

136KB
MD5

042f03c2b5971e5996956871d43b98ae
SHA1

8bf98aa12aa71c1d064d8a9d9ddd6f2c9f68dfb4
SHA256

f01c0873e828b23464f884d7b97066ce21103203960461704bf699a0a7884bf2
SHA512

828ee3fb6d761ad6315e6eeb8af5bc92841f6ff433cb3f9d5bc6cf2cac77bf2a8209286e32310c59bf51dd33ac61bbd0f72148207ad5786890968f2a75f1452b
SSDEEP

1536:1HPWeHPsFFBpNvWsZSsRX25xgnP6rL72H4ySeJAXDvtAb:14HvWsZTRG5AmLqHzyDFAb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2208	2344	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2208	2344	042f03c2b5971e5996956871d43b98ae.exe	28
PID 2344 wrote to memory of 2208	2344	042f03c2b5971e5996956871d43b98ae.exe	28
PID 2344 wrote to memory of 2208	2344	042f03c2b5971e5996956871d43b98ae.exe	28
PID 2344 wrote to memory of 2208	2344	042f03c2b5971e5996956871d43b98ae.exe	28

C:\Users\Admin\AppData\Local\Temp\042f03c2b5971e5996956871d43b98ae.exe
"C:\Users\Admin\AppData\Local\Temp\042f03c2b5971e5996956871d43b98ae.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 88
  2⤵
  - Program crash
  PID:2208

memory/2344-0-0x00000000013B0000-0x00000000013D2000-memory.dmp

Filesize
136KB

Download
memory/2344-1-0x00000000013B0000-0x00000000013D2000-memory.dmp

Filesize
136KB

Download