971ee4b86d6b0c42360078b8a2df8bab7c104cdf805e0146d8cacd61adbdedbe

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 11:52

Target

1c31aed1accaf94322bfddd4d9949769.exe
Size

55KB
MD5

1c31aed1accaf94322bfddd4d9949769
SHA1

58ae5ba483de4e1c7d32c48795f8493ebf357dda
SHA256

971ee4b86d6b0c42360078b8a2df8bab7c104cdf805e0146d8cacd61adbdedbe
SHA512

711234879b71e224677e5bdb1a8cb5f9defe56f783496ab7ece8b06f70d552e3c3db50c393ee29a6c0abacba82fbc0a544ccdd60157cc01516b89a473dab25ec
SSDEEP

1536:AkE6HH/zwudqyOWjOAFBPVoQisWibVUXliLFXCe:pnbwudBXOAFBPVoQisWiRoluFXl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1044	1788	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1044	1788	1c31aed1accaf94322bfddd4d9949769.exe	28
PID 1788 wrote to memory of 1044	1788	1c31aed1accaf94322bfddd4d9949769.exe	28
PID 1788 wrote to memory of 1044	1788	1c31aed1accaf94322bfddd4d9949769.exe	28
PID 1788 wrote to memory of 1044	1788	1c31aed1accaf94322bfddd4d9949769.exe	28

C:\Users\Admin\AppData\Local\Temp\1c31aed1accaf94322bfddd4d9949769.exe
"C:\Users\Admin\AppData\Local\Temp\1c31aed1accaf94322bfddd4d9949769.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 140
  2⤵
  - Program crash
  PID:1044

memory/1788-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download