bdd69ea7b844b24819de220005a145beed27c1f3e128ab38a8c8d0cf13560f29

Analysis

max time kernel
142s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:05

Target

15f6abd3a5aeedd8d5e6a55e70d935be.exe
Size

260KB
MD5

15f6abd3a5aeedd8d5e6a55e70d935be
SHA1

26056160c3baa9aa33ca6fd7d56834315d918e24
SHA256

bdd69ea7b844b24819de220005a145beed27c1f3e128ab38a8c8d0cf13560f29
SHA512

b8f4bf4da9161d78d19b427ec1a19c514449a215d679c24f6fd35e331946240c90d36ed53e5be8def33050e4187dfffefe66cc25ebbd8cfeb8414d63c7571564
SSDEEP

384:fpqWv9hVhwlc9XYhevksMuU2coP5pD6YD+uijPX7+lcAYA9n:x7zi5kh9lcoRRF+DKZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2896	2596	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2896	2596	15f6abd3a5aeedd8d5e6a55e70d935be.exe	29
PID 2596 wrote to memory of 2896	2596	15f6abd3a5aeedd8d5e6a55e70d935be.exe	29
PID 2596 wrote to memory of 2896	2596	15f6abd3a5aeedd8d5e6a55e70d935be.exe	29
PID 2596 wrote to memory of 2896	2596	15f6abd3a5aeedd8d5e6a55e70d935be.exe	29

C:\Users\Admin\AppData\Local\Temp\15f6abd3a5aeedd8d5e6a55e70d935be.exe
"C:\Users\Admin\AppData\Local\Temp\15f6abd3a5aeedd8d5e6a55e70d935be.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 48
  2⤵
  - Program crash
  PID:2896

memory/2596-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download