c263e0bfc57f8116d03338e8f790947396f75e9896d8a180cbacb27024043773

Analysis

max time kernel
122s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 09:04

Target

13b904ea97a199a0fe9718db1cd98bb1.exe
Size

118KB
MD5

13b904ea97a199a0fe9718db1cd98bb1
SHA1

6ad495374ded61319273214b0bdf222548b6c060
SHA256

c263e0bfc57f8116d03338e8f790947396f75e9896d8a180cbacb27024043773
SHA512

8588a662a806db2049de671a72b524e3ef89949b2eacb0e8327690999ab744dd208c16d8c9471a04cf760963a3af3fd9a3b85ffe111b476e238dc470b0149904
SSDEEP

1536:dbdo6pwas3BEBGviCxaOdHJTLusq/LpqXNWfBPLDFZLlKtrs/oWXZtS:db+uwZx3vij+JdK49WfhhKtA/Lu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2188	1672	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2188	1672	13b904ea97a199a0fe9718db1cd98bb1.exe	28
PID 1672 wrote to memory of 2188	1672	13b904ea97a199a0fe9718db1cd98bb1.exe	28
PID 1672 wrote to memory of 2188	1672	13b904ea97a199a0fe9718db1cd98bb1.exe	28
PID 1672 wrote to memory of 2188	1672	13b904ea97a199a0fe9718db1cd98bb1.exe	28

C:\Users\Admin\AppData\Local\Temp\13b904ea97a199a0fe9718db1cd98bb1.exe
"C:\Users\Admin\AppData\Local\Temp\13b904ea97a199a0fe9718db1cd98bb1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 168
  2⤵
  - Program crash
  PID:2188

memory/1672-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download