e0f159e01e078d02a4daec825712db05934729dd31d7c90469d33e8956dd7389

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 08:46

Target

12eaebf4678b9d760e69aa473c93dd58.exe
Size

576KB
MD5

12eaebf4678b9d760e69aa473c93dd58
SHA1

8fe93f973850d3b35e746748b8b217dfece54455
SHA256

e0f159e01e078d02a4daec825712db05934729dd31d7c90469d33e8956dd7389
SHA512

15c4f07ad282ce02884b0c9663990086cca8d2a0ee1abd77cfdce8670e6ac9a8fc4bdc2f731c9ed99e5019002a24d62c400092c09fb574db3d26850140a66897
SSDEEP

12288:jmnMGFLiQngHwFeR5MIGnUPbdQgu/AIqK3SehqKq/tqcUuEz6pWcTlPI:jRGJiBH1kTz9q/tqKEzSWcTlPI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2384	2148	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2384	2148	12eaebf4678b9d760e69aa473c93dd58.exe	14
PID 2148 wrote to memory of 2384	2148	12eaebf4678b9d760e69aa473c93dd58.exe	14
PID 2148 wrote to memory of 2384	2148	12eaebf4678b9d760e69aa473c93dd58.exe	14
PID 2148 wrote to memory of 2384	2148	12eaebf4678b9d760e69aa473c93dd58.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 168
1⤵
- Program crash
PID:2384

C:\Users\Admin\AppData\Local\Temp\12eaebf4678b9d760e69aa473c93dd58.exe
"C:\Users\Admin\AppData\Local\Temp\12eaebf4678b9d760e69aa473c93dd58.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2148

memory/2148-0-0x0000000000C60000-0x0000000000CF4000-memory.dmp

Filesize
592KB

Download