23d22ceb7560ac705de032959dad0e3a00c643e02200fb5e4364afa63e8ededb

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 05:48

Target

0930e0d0884748c9bf8875cc5f13b7c2.exe
Size

97KB
MD5

0930e0d0884748c9bf8875cc5f13b7c2
SHA1

261a4b77b475c5a2174d0fec50ac751f067c2859
SHA256

23d22ceb7560ac705de032959dad0e3a00c643e02200fb5e4364afa63e8ededb
SHA512

1a565ccd775d3a7a15cbd1c7f3a4b0673243671b0e1d7135537f335d85169a11a25dff7843650b4526282f998941d081224a63fb6ea7342dda2ad010addd5129
SSDEEP

1536:REikblh4WLb5oW9FnDH+fApdpTBvHir6aOvJ3zhB1Eq:JkblbLdo0DH+fKdp5Hy6a0z6q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2256	2220	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2256	2220	0930e0d0884748c9bf8875cc5f13b7c2.exe	14
PID 2220 wrote to memory of 2256	2220	0930e0d0884748c9bf8875cc5f13b7c2.exe	14
PID 2220 wrote to memory of 2256	2220	0930e0d0884748c9bf8875cc5f13b7c2.exe	14
PID 2220 wrote to memory of 2256	2220	0930e0d0884748c9bf8875cc5f13b7c2.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 140
1⤵
- Program crash
PID:2256

C:\Users\Admin\AppData\Local\Temp\0930e0d0884748c9bf8875cc5f13b7c2.exe
"C:\Users\Admin\AppData\Local\Temp\0930e0d0884748c9bf8875cc5f13b7c2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220

memory/2220-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2220-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download