3492d7ab074bcba4e2d352c6bd5eb4a7ad0b3d33e0708c2b650c484f7deb629e

Analysis

max time kernel
121s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 11:12

Target

19d71c7e1c1a80f64fe04c4ec3dd2a14.exe
Size

367KB
MD5

19d71c7e1c1a80f64fe04c4ec3dd2a14
SHA1

542b02a8f5e5c17b2e954c8d06b944398f48db93
SHA256

3492d7ab074bcba4e2d352c6bd5eb4a7ad0b3d33e0708c2b650c484f7deb629e
SHA512

0615a84a94e2f0bd7f09c9d3fa5a1e7e2ea637cde9e77616db80dac3ac6fe0ce963f68ffd5ccaac0755d8c431a5a25928868257694da48836e4afe355528ce47
SSDEEP

6144:rpEcAd/Mm5ZkyUneRTnJOmQ4W4/6zA5K0TzJRCp4xRvKUllD/W13+M:rTAOm5eyUnJmCzAXTzJR3RvK6lCwM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2652	2200	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2652	2200	19d71c7e1c1a80f64fe04c4ec3dd2a14.exe	28
PID 2200 wrote to memory of 2652	2200	19d71c7e1c1a80f64fe04c4ec3dd2a14.exe	28
PID 2200 wrote to memory of 2652	2200	19d71c7e1c1a80f64fe04c4ec3dd2a14.exe	28
PID 2200 wrote to memory of 2652	2200	19d71c7e1c1a80f64fe04c4ec3dd2a14.exe	28

C:\Users\Admin\AppData\Local\Temp\19d71c7e1c1a80f64fe04c4ec3dd2a14.exe
"C:\Users\Admin\AppData\Local\Temp\19d71c7e1c1a80f64fe04c4ec3dd2a14.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 116
  2⤵
  - Program crash
  PID:2652

memory/2200-0-0x00000000012B0000-0x0000000001310000-memory.dmp

Filesize
384KB

Download