e406ff942ad7a6250b803b13817484578633745981a0868857e2c296bff7213b

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 04:43

Target

05d0de56b8adc2012ffe976636655094.exe
Size

547KB
MD5

05d0de56b8adc2012ffe976636655094
SHA1

2ab42dca9735c68560f8fe1169e5d5c48bf04e22
SHA256

e406ff942ad7a6250b803b13817484578633745981a0868857e2c296bff7213b
SHA512

66e74ea707d6554053c7f8e9fa49ff0b5f1aea59278d99e1d577daca81ee7bc52979c3b14b38345875ed9b821c61ce21841e44fce416c767638a1e65c12173fd
SSDEEP

12288:vZ7iKcvOwBxujDIhEh9zgDAq5YRWLNMNDIj8Whb7ZO+:vZ7iJBkwO9z2Je8wWpU+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2372	2980	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2372	2980	05d0de56b8adc2012ffe976636655094.exe	16
PID 2980 wrote to memory of 2372	2980	05d0de56b8adc2012ffe976636655094.exe	16
PID 2980 wrote to memory of 2372	2980	05d0de56b8adc2012ffe976636655094.exe	16
PID 2980 wrote to memory of 2372	2980	05d0de56b8adc2012ffe976636655094.exe	16

C:\Users\Admin\AppData\Local\Temp\05d0de56b8adc2012ffe976636655094.exe
"C:\Users\Admin\AppData\Local\Temp\05d0de56b8adc2012ffe976636655094.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 124
  2⤵
  - Program crash
  PID:2372

memory/2980-2-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/2980-5-0x0000000002000000-0x0000000002010000-memory.dmp

Filesize
64KB

Download
memory/2980-6-0x0000000077E70000-0x0000000077E71000-memory.dmp

Filesize
4KB

Download
memory/2980-10-0x0000000077E71000-0x0000000077E72000-memory.dmp

Filesize
4KB

Download
memory/2980-9-0x0000000002000000-0x0000000002010000-memory.dmp

Filesize
64KB

Download
memory/2980-8-0x0000000076000000-0x0000000076110000-memory.dmp

Filesize
1.1MB

Download
memory/2980-7-0x0000000077E6F000-0x0000000077E70000-memory.dmp

Filesize
4KB

Download
memory/2980-4-0x00000000005D0000-0x00000000005E0000-memory.dmp

Filesize
64KB

Download
memory/2980-3-0x0000000000260000-0x0000000000299000-memory.dmp

Filesize
228KB

Download
memory/2980-1-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2980-11-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2980-12-0x00000000005D0000-0x00000000005E0000-memory.dmp

Filesize
64KB

Download
memory/2980-14-0x0000000000260000-0x0000000000299000-memory.dmp

Filesize
228KB

Download
memory/2980-15-0x0000000002000000-0x0000000002010000-memory.dmp

Filesize
64KB

Download