0c0b1192a64f363bca134d5418a1723f2d5b10f6e372e9bcda5e16d71a5406a1

Analysis

max time kernel
119s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 05:55

Target

09a5f444c4172eddbe1aac112f2aa572.exe
Size

422KB
MD5

09a5f444c4172eddbe1aac112f2aa572
SHA1

f5fc24fb16aae6cb9be04575f89c3d9e99159f67
SHA256

0c0b1192a64f363bca134d5418a1723f2d5b10f6e372e9bcda5e16d71a5406a1
SHA512

9ba1c93854f8b833a5c9c8342f34eeff507df73eccfc3c06ea8f909712aefc2a33e4d1b0046e529541d169e876c5aaba35a887702180c98fa6550faa662ac502
SSDEEP

6144:ykB1INZdWaFzaE7mDGg7Y4+MFyBPys80G5sEOi9Ri9na5UVx3:ykBgdW/E7mDGg8xMkBp80GiZa5UVh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2412	632	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 2412	632	09a5f444c4172eddbe1aac112f2aa572.exe	28
PID 632 wrote to memory of 2412	632	09a5f444c4172eddbe1aac112f2aa572.exe	28
PID 632 wrote to memory of 2412	632	09a5f444c4172eddbe1aac112f2aa572.exe	28
PID 632 wrote to memory of 2412	632	09a5f444c4172eddbe1aac112f2aa572.exe	28

C:\Users\Admin\AppData\Local\Temp\09a5f444c4172eddbe1aac112f2aa572.exe
"C:\Users\Admin\AppData\Local\Temp\09a5f444c4172eddbe1aac112f2aa572.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 116
  2⤵
  - Program crash
  PID:2412

memory/632-0-0x0000000000830000-0x000000000089E000-memory.dmp

Filesize
440KB

Download