a0b8c4f8b01802df0b8094a2a0ceef8cf16195ae180fe948859e50ae52b771bf

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 07:21

Target

0e5c6aab4929f3b134081b9a3077c805.exe
Size

76KB
MD5

0e5c6aab4929f3b134081b9a3077c805
SHA1

a8f471d498b6636c5574f19279935e7ed647126a
SHA256

a0b8c4f8b01802df0b8094a2a0ceef8cf16195ae180fe948859e50ae52b771bf
SHA512

53314915e550ac653d1293679c528305444c92235daaaed93b7442e19e828bed5475fe22f004f31729c7420b163bca57db893f983f1d10be1480c6edb73187fb
SSDEEP

1536:G/ePyXHZ7DA4BfBrmTiXvvvUgbFNCuACP1DIgN:keSHZ7DTBfBrB/UgbFNCuAq2C

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1724	2456	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 1724	2456	0e5c6aab4929f3b134081b9a3077c805.exe	28
PID 2456 wrote to memory of 1724	2456	0e5c6aab4929f3b134081b9a3077c805.exe	28
PID 2456 wrote to memory of 1724	2456	0e5c6aab4929f3b134081b9a3077c805.exe	28
PID 2456 wrote to memory of 1724	2456	0e5c6aab4929f3b134081b9a3077c805.exe	28

C:\Users\Admin\AppData\Local\Temp\0e5c6aab4929f3b134081b9a3077c805.exe
"C:\Users\Admin\AppData\Local\Temp\0e5c6aab4929f3b134081b9a3077c805.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 108
  2⤵
  - Program crash
  PID:1724

memory/2456-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2456-1-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download