e23343e1df84347b98910e1a0958630205bff9db056a934f3f8ea7efad170028

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 11:49

Target

1bf599090594e1877859326d9cdeb833.exe
Size

81KB
MD5

1bf599090594e1877859326d9cdeb833
SHA1

b062150dd3db045d69d0f18fe47ff127ef833af9
SHA256

e23343e1df84347b98910e1a0958630205bff9db056a934f3f8ea7efad170028
SHA512

a88b9028faecf8c079e91d7542f3736c897344bd66d2ac160762117a74561a22020d65e90a3bb8c27c2814a08536f9e70a299c57643ad06698fbb56e3c22686b
SSDEEP

768:ZrCVa45J1yppJX6Zo3o/L8eltnJRQEDqAnf9/OZU9qZU9SnUg:ZrGvj0pDb3of9JRv9OpUg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2444	1964	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2444	1964	1bf599090594e1877859326d9cdeb833.exe	28
PID 1964 wrote to memory of 2444	1964	1bf599090594e1877859326d9cdeb833.exe	28
PID 1964 wrote to memory of 2444	1964	1bf599090594e1877859326d9cdeb833.exe	28
PID 1964 wrote to memory of 2444	1964	1bf599090594e1877859326d9cdeb833.exe	28

C:\Users\Admin\AppData\Local\Temp\1bf599090594e1877859326d9cdeb833.exe
"C:\Users\Admin\AppData\Local\Temp\1bf599090594e1877859326d9cdeb833.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 36
  2⤵
  - Program crash
  PID:2444