440f8986fc5ccafec74d78d331b0b44eec326e735c53f79f1f869d767fd28644

Analysis

max time kernel
118s
max time network
158s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 09:03

Target

13ad59b29401f00e0917e1772cf8c930.exe
Size

430KB
MD5

13ad59b29401f00e0917e1772cf8c930
SHA1

8ffcb5163f43b8dcb7a03d771a32df66fe517d67
SHA256

440f8986fc5ccafec74d78d331b0b44eec326e735c53f79f1f869d767fd28644
SHA512

53c5180bf637390aeef50e360c974ff7f04fa02a89de3bccd2c06e291f982bd64ece643fa032d45720a1c34bfbee1e198e97835d39788dbedb20bd6bb60d9e32
SSDEEP

6144:Ulsy4TNbEm1B1zzqaCh9Ju/2x+vw0b8ajNglS2+gUXpP9YC4r:UdwNIm1B1zzqrh9Jf+btwSfgUnBI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2588	2620	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2588	2620	13ad59b29401f00e0917e1772cf8c930.exe	29
PID 2620 wrote to memory of 2588	2620	13ad59b29401f00e0917e1772cf8c930.exe	29
PID 2620 wrote to memory of 2588	2620	13ad59b29401f00e0917e1772cf8c930.exe	29
PID 2620 wrote to memory of 2588	2620	13ad59b29401f00e0917e1772cf8c930.exe	29

C:\Users\Admin\AppData\Local\Temp\13ad59b29401f00e0917e1772cf8c930.exe
"C:\Users\Admin\AppData\Local\Temp\13ad59b29401f00e0917e1772cf8c930.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 116
  2⤵
  - Program crash
  PID:2588

memory/2620-0-0x0000000000220000-0x0000000000290000-memory.dmp

Filesize
448KB

Download