c18bfab54ca6e77b39231ce8f38a7f0ce6a9f5caf974eff1e597b0bd20c319cd

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 11:15

Target

1a0bf78c45e16b52a8e965b1d438803e.exe
Size

24KB
MD5

1a0bf78c45e16b52a8e965b1d438803e
SHA1

9abc9f8183a29bde7745675b06928c61306343c6
SHA256

c18bfab54ca6e77b39231ce8f38a7f0ce6a9f5caf974eff1e597b0bd20c319cd
SHA512

d6ab614aa39c0e341c08295587cc6585d7e118cd507494f78163365ccbb8b2bc605e28785f0ee5f0bbcaa66f46f32249cfdcade1662736502a37d26fc0dc8ca5
SSDEEP

192:XqOS/n/n/n/szEt1KDq5joR/rN5iFz956tq/n/n/n/fn/n/n/n/n/n/n/n/n/n/f:xwtcq5UVrN5yzTpjNZHbSqS6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1936	2112	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 1936	2112	1a0bf78c45e16b52a8e965b1d438803e.exe	28
PID 2112 wrote to memory of 1936	2112	1a0bf78c45e16b52a8e965b1d438803e.exe	28
PID 2112 wrote to memory of 1936	2112	1a0bf78c45e16b52a8e965b1d438803e.exe	28
PID 2112 wrote to memory of 1936	2112	1a0bf78c45e16b52a8e965b1d438803e.exe	28

C:\Users\Admin\AppData\Local\Temp\1a0bf78c45e16b52a8e965b1d438803e.exe
"C:\Users\Admin\AppData\Local\Temp\1a0bf78c45e16b52a8e965b1d438803e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 92
  2⤵
  - Program crash
  PID:1936

memory/2112-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2112-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download