c61c207f2f0075a0833e2e1407bf85ac6536e56433c835012f8e207e9c077851

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 04:45

Target

05e843306e57f9df27a9a2c665e8a891.exe
Size

39KB
MD5

05e843306e57f9df27a9a2c665e8a891
SHA1

b289973fd2e7d52b6167fecbc00ca5ad27738fc1
SHA256

c61c207f2f0075a0833e2e1407bf85ac6536e56433c835012f8e207e9c077851
SHA512

0bccea4f0743c38e25d1325ef3ca8936e1ecd5a9a72a9c1aebeab5bd59b3ab2b0c56de628bb1a94e30fe00024abaa9a0a15d01b79b2546940a56f156543257b5
SSDEEP

768:PiGTTcW83id4TeiZoVWaBwkEno0L7UTLurf6U25MBacRnWG:6Q4VkEo8UTarO5MQcRt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	2448	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 1696	2448	05e843306e57f9df27a9a2c665e8a891.exe	28
PID 2448 wrote to memory of 1696	2448	05e843306e57f9df27a9a2c665e8a891.exe	28
PID 2448 wrote to memory of 1696	2448	05e843306e57f9df27a9a2c665e8a891.exe	28
PID 2448 wrote to memory of 1696	2448	05e843306e57f9df27a9a2c665e8a891.exe	28

C:\Users\Admin\AppData\Local\Temp\05e843306e57f9df27a9a2c665e8a891.exe
"C:\Users\Admin\AppData\Local\Temp\05e843306e57f9df27a9a2c665e8a891.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 88
  2⤵
  - Program crash
  PID:1696

memory/2448-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download