0ab39ea5cdd161ea1ef3d2a52034db36a2475cf7ab4de349d0bd26b989f7816d

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 08:28

Target

11fe19924ad1a7851d2c9c4de70ac075.exe
Size

102KB
MD5

11fe19924ad1a7851d2c9c4de70ac075
SHA1

481f2b655927c217b0ab74fea29ea05d9fc3f680
SHA256

0ab39ea5cdd161ea1ef3d2a52034db36a2475cf7ab4de349d0bd26b989f7816d
SHA512

93a1049d812b315e3f9e46238758b2e52a54623c768b01f5c650e35c51368de853f4d7d98fd1996843d4e7bcc780e1894cf50323de61f9d37a4a63db7f2236b0
SSDEEP

1536:aS9km6KZ8ZAxB6IY1u2uuCeiMTEcGTsI/QDzNx62wlf0jfgLR1H:mmz8ZuB6JYqX7VA/w62wVnLR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1384	2532	WerFault.exe	3

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1384	2532	11fe19924ad1a7851d2c9c4de70ac075.exe	28
PID 2532 wrote to memory of 1384	2532	11fe19924ad1a7851d2c9c4de70ac075.exe	28
PID 2532 wrote to memory of 1384	2532	11fe19924ad1a7851d2c9c4de70ac075.exe	28
PID 2532 wrote to memory of 1384	2532	11fe19924ad1a7851d2c9c4de70ac075.exe	28

C:\Users\Admin\AppData\Local\Temp\11fe19924ad1a7851d2c9c4de70ac075.exe
"C:\Users\Admin\AppData\Local\Temp\11fe19924ad1a7851d2c9c4de70ac075.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 168
  2⤵
  - Program crash
  PID:1384

memory/2532-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download