05c7ca0c8b9a805c8c5b68a0f91d40242b9e7f794b610ebb7871299428f16c0e

Analysis

max time kernel
122s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 06:01

Target

0a05ec0ae0a402137ff50a137652d539.exe
Size

225KB
MD5

0a05ec0ae0a402137ff50a137652d539
SHA1

a3926e69ee85bdbbf4805366e65e55a4772bdd08
SHA256

05c7ca0c8b9a805c8c5b68a0f91d40242b9e7f794b610ebb7871299428f16c0e
SHA512

779de0183dc73b9ebf4faff970bf5e0a890198df67cce37cf784772a3d107cb637ef5316c775cad642ac92f69173ddb777ac308b79fa954df98286f050f7c3f6
SSDEEP

3072:uOpBokRdaHQoKyNQHy+CmQlxDgDVdc+fL71WNDJ2NbOZrhrOxOY0l8KbsTtZD9gm:uOLxRduQty+CbgjL71WER0Ky2ttSCX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2948	2836	WerFault.exe	11

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2948	2836	0a05ec0ae0a402137ff50a137652d539.exe	18
PID 2836 wrote to memory of 2948	2836	0a05ec0ae0a402137ff50a137652d539.exe	18
PID 2836 wrote to memory of 2948	2836	0a05ec0ae0a402137ff50a137652d539.exe	18
PID 2836 wrote to memory of 2948	2836	0a05ec0ae0a402137ff50a137652d539.exe	18

C:\Users\Admin\AppData\Local\Temp\0a05ec0ae0a402137ff50a137652d539.exe
"C:\Users\Admin\AppData\Local\Temp\0a05ec0ae0a402137ff50a137652d539.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 132
  2⤵
  - Program crash
  PID:2948

memory/2836-0-0x0000000000B70000-0x0000000000B7F000-memory.dmp

Filesize
60KB

Download