18a5e25c8d81e7c9cc3a668481c4e21e58a3088a123f1eedc1838f842fcc884b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 04:55

Target

065f477487d68ba71e54f93ca6206d4c.exe
Size

76KB
MD5

065f477487d68ba71e54f93ca6206d4c
SHA1

be0b38af001cf5260ea5d991d2959be56baee228
SHA256

18a5e25c8d81e7c9cc3a668481c4e21e58a3088a123f1eedc1838f842fcc884b
SHA512

070cf16d199dcb224686a8bed28647e159cf92cdc6ddff40041aaefff1575c7b25a3e0ff43428996e6568959961fee05294c04fb8ccf5521f4aa351877bf9423
SSDEEP

1536:OhhhhgkzmdJEaD2LPfll6Rb4TE1dmcdh5JOdapHIcyfDuQGpjVrs2ryrd1vUQuq6:Mmxs3ly4TErLUa/Iu7Hs2qo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2844	2472	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2844	2472	065f477487d68ba71e54f93ca6206d4c.exe	28
PID 2472 wrote to memory of 2844	2472	065f477487d68ba71e54f93ca6206d4c.exe	28
PID 2472 wrote to memory of 2844	2472	065f477487d68ba71e54f93ca6206d4c.exe	28
PID 2472 wrote to memory of 2844	2472	065f477487d68ba71e54f93ca6206d4c.exe	28

C:\Users\Admin\AppData\Local\Temp\065f477487d68ba71e54f93ca6206d4c.exe
"C:\Users\Admin\AppData\Local\Temp\065f477487d68ba71e54f93ca6206d4c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 36
  2⤵
  - Program crash
  PID:2844

memory/2472-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download