7db393b637ec351aec41c741a964a3dfe0dc2541712f166e67c070e092d8c9cb

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 08:52

Target

1339e490d76d39891f691747c36120d2.exe
Size

102KB
MD5

1339e490d76d39891f691747c36120d2
SHA1

1050b8f4dae941118b9fd7c155dd9fe898294a0c
SHA256

7db393b637ec351aec41c741a964a3dfe0dc2541712f166e67c070e092d8c9cb
SHA512

4e62db4f0aa3679ce9f075b8153977e9ee59cdb1f51454666a0b06d474d09c0b389883cc0b13217f9ca2c1e616ae5c9dd64ed833de58d378aef9bce9c9c3a5e4
SSDEEP

1536:aS9km6KZ8ZAxB6IY1u2uuCeiMTEcGTsI/QDzNx62wlf0jfgXR1H:mmz8ZuB6JYqX7VA/w62wVnXR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2992	2976	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2992	2976	1339e490d76d39891f691747c36120d2.exe	28
PID 2976 wrote to memory of 2992	2976	1339e490d76d39891f691747c36120d2.exe	28
PID 2976 wrote to memory of 2992	2976	1339e490d76d39891f691747c36120d2.exe	28
PID 2976 wrote to memory of 2992	2976	1339e490d76d39891f691747c36120d2.exe	28

C:\Users\Admin\AppData\Local\Temp\1339e490d76d39891f691747c36120d2.exe
"C:\Users\Admin\AppData\Local\Temp\1339e490d76d39891f691747c36120d2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 168
  2⤵
  - Program crash
  PID:2992

memory/2976-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download