2adc889abf9eb905bf4294d49e24276206316a278bc02bd9886b5637f5610ab0

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 08:09

Target

111e34676c31799322aa49005e7cd57a.exe
Size

115KB
MD5

111e34676c31799322aa49005e7cd57a
SHA1

f069b889df8144af217c6a53d5bf2464b957330f
SHA256

2adc889abf9eb905bf4294d49e24276206316a278bc02bd9886b5637f5610ab0
SHA512

b7cbeacfc6c5232bf24426da9bd92b7c994959bb1bb8b2a27a3a3252070832fe2157b9d2af241e2f0ee0434d20e8de1cf2340cd0b77874eac66575ee61e01992
SSDEEP

1536:UkoAzrk0MkJaG3Tmi8eCWWAu4+y268gtZYL86T7EZ3c:JRzrnMZG318eCWlkyB86ZY46UO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2536	1924	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2536	1924	111e34676c31799322aa49005e7cd57a.exe	28
PID 1924 wrote to memory of 2536	1924	111e34676c31799322aa49005e7cd57a.exe	28
PID 1924 wrote to memory of 2536	1924	111e34676c31799322aa49005e7cd57a.exe	28
PID 1924 wrote to memory of 2536	1924	111e34676c31799322aa49005e7cd57a.exe	28

C:\Users\Admin\AppData\Local\Temp\111e34676c31799322aa49005e7cd57a.exe
"C:\Users\Admin\AppData\Local\Temp\111e34676c31799322aa49005e7cd57a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 132
  2⤵
  - Program crash
  PID:2536

memory/1924-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download