786ef7785132783394995ab60d59d8d8af7b16b276740e6d2b014dac812039d0

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 08:37

Target

126d36e80971323c1ed76e7c6c93c50c.exe
Size

118KB
MD5

126d36e80971323c1ed76e7c6c93c50c
SHA1

ebedadd53b9cc9c57bcbb135cfc7f8ccbe3a78d2
SHA256

786ef7785132783394995ab60d59d8d8af7b16b276740e6d2b014dac812039d0
SHA512

237763fc906b248e99679cc2d69d5f57ae56a12505163e402b63f320bb0c043b5590347c5d8c0eef7a7208a90cf0c1c4ebc1af061b84b74eac0e3d35e48f1a8e
SSDEEP

3072:IHPgWQZEnRBoK8RIEWjXulkCVVKFflypaMNPh8iVB:4PgWvRB98RI5fCXUMNPSm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2328	2352	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2328	2352	126d36e80971323c1ed76e7c6c93c50c.exe	11
PID 2352 wrote to memory of 2328	2352	126d36e80971323c1ed76e7c6c93c50c.exe	11
PID 2352 wrote to memory of 2328	2352	126d36e80971323c1ed76e7c6c93c50c.exe	11
PID 2352 wrote to memory of 2328	2352	126d36e80971323c1ed76e7c6c93c50c.exe	11

C:\Users\Admin\AppData\Local\Temp\126d36e80971323c1ed76e7c6c93c50c.exe
"C:\Users\Admin\AppData\Local\Temp\126d36e80971323c1ed76e7c6c93c50c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 44
  2⤵
  - Program crash
  PID:2328