d48215f0c9655fc73c1d5fed9c43f4ba4aa8a6d1eceba51d082536ff4e03dcd8

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 07:10

Target

0dd61dc220e850a89ffdc4b4b8bd273d.exe
Size

33KB
MD5

0dd61dc220e850a89ffdc4b4b8bd273d
SHA1

519ade6bc44abed793190d76eeb7f420aa5ec7e0
SHA256

d48215f0c9655fc73c1d5fed9c43f4ba4aa8a6d1eceba51d082536ff4e03dcd8
SHA512

f51c5ed6c54393db7f020ec76b2715e88a7f8d05a0b0515c99fe2fe5c1357da8e39eb9225c4fc3ee844d10119dd08b04a00e9391b6a2dad077fc1ed788dc2b88
SSDEEP

384:xXQcl4fqnww7HPzbDkVjeW7fUd//3pHyYYMW/JLcyJFEEAg7WtsXQmh7IGJavex:FF7x/44W7f25SY5eJLcaKgCCXQmxIiag

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2284	2172	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2284	2172	0dd61dc220e850a89ffdc4b4b8bd273d.exe	28
PID 2172 wrote to memory of 2284	2172	0dd61dc220e850a89ffdc4b4b8bd273d.exe	28
PID 2172 wrote to memory of 2284	2172	0dd61dc220e850a89ffdc4b4b8bd273d.exe	28
PID 2172 wrote to memory of 2284	2172	0dd61dc220e850a89ffdc4b4b8bd273d.exe	28

C:\Users\Admin\AppData\Local\Temp\0dd61dc220e850a89ffdc4b4b8bd273d.exe
"C:\Users\Admin\AppData\Local\Temp\0dd61dc220e850a89ffdc4b4b8bd273d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 88
  2⤵
  - Program crash
  PID:2284

memory/2172-0-0x0000000009100000-0x000000000910B000-memory.dmp

Filesize
44KB

Download
memory/2172-1-0x0000000077370000-0x0000000077480000-memory.dmp

Filesize
1.1MB

Download