43e5d028c526c7ca53e8d39f6fb1e561a32072a801534a50eaa0b0837e6db6a5

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 05:06

Target

06c72517f83df0b1aac1e8d8c538ab92.exe
Size

200KB
MD5

06c72517f83df0b1aac1e8d8c538ab92
SHA1

3df8c7b2a09df3d3d9db6b49b82d561b345036ea
SHA256

43e5d028c526c7ca53e8d39f6fb1e561a32072a801534a50eaa0b0837e6db6a5
SHA512

c25b581b95d0a13f1235574fef95cbf33185881026958d095a40c358a5767f46fa831ba19f7db88b5c3487cd2cde917044825e28e13c19e4f8d525de51af6b72
SSDEEP

3072:hNDl5W/awSLd1W1vcB18FRtFmMnxh4UffdwhCp9dm5iomMGFitw:95WNSLvW1vOCtFmMTffeCfomhFi+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2816	2188	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2816	2188	06c72517f83df0b1aac1e8d8c538ab92.exe	16
PID 2188 wrote to memory of 2816	2188	06c72517f83df0b1aac1e8d8c538ab92.exe	16
PID 2188 wrote to memory of 2816	2188	06c72517f83df0b1aac1e8d8c538ab92.exe	16
PID 2188 wrote to memory of 2816	2188	06c72517f83df0b1aac1e8d8c538ab92.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 120
1⤵
- Program crash
PID:2816

C:\Users\Admin\AppData\Local\Temp\06c72517f83df0b1aac1e8d8c538ab92.exe
"C:\Users\Admin\AppData\Local\Temp\06c72517f83df0b1aac1e8d8c538ab92.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188

memory/2188-1-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2188-4-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download
memory/2188-9-0x0000000009140000-0x00000000091B7000-memory.dmp

Filesize
476KB

Download
memory/2188-8-0x00000000002D0000-0x00000000002D2000-memory.dmp

Filesize
8KB

Download
memory/2188-6-0x00000000002C0000-0x00000000002C2000-memory.dmp

Filesize
8KB

Download
memory/2188-3-0x0000000000330000-0x00000000003AC000-memory.dmp

Filesize
496KB

Download
memory/2188-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2188-12-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download
memory/2188-14-0x00000000002B0000-0x00000000002B2000-memory.dmp

Filesize
8KB

Download
memory/2188-13-0x00000000002C0000-0x00000000002C2000-memory.dmp

Filesize
8KB

Download