be2010ff346d24c02b3ed242ac92d3b18ba1421679dfd8e5c11d7af58f1c6f6a

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 12:47

Target

1f9ce4a15d8b566fb37ebd6a0fe5751e.exe
Size

422KB
MD5

1f9ce4a15d8b566fb37ebd6a0fe5751e
SHA1

9c37ca51987a3851f01383197d429b5f83b33969
SHA256

be2010ff346d24c02b3ed242ac92d3b18ba1421679dfd8e5c11d7af58f1c6f6a
SHA512

1e5aafe700b78e960910d672ab9137c9634717e8901d9e2c18b9c85e9549aa7e252d6a721c8eaca393004c2da722046171ad55d4029492431273b0443ed0c71f
SSDEEP

6144:ykB1INZdWaFzaE7mDGg7Y4+MFyBPys80G5sEOi9Ri9na5UVx3:ykBgdW/E7mDGg8xMkBp80GiZa5UVh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
628	1480	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 628	1480	1f9ce4a15d8b566fb37ebd6a0fe5751e.exe	15
PID 1480 wrote to memory of 628	1480	1f9ce4a15d8b566fb37ebd6a0fe5751e.exe	15
PID 1480 wrote to memory of 628	1480	1f9ce4a15d8b566fb37ebd6a0fe5751e.exe	15
PID 1480 wrote to memory of 628	1480	1f9ce4a15d8b566fb37ebd6a0fe5751e.exe	15

C:\Users\Admin\AppData\Local\Temp\1f9ce4a15d8b566fb37ebd6a0fe5751e.exe
"C:\Users\Admin\AppData\Local\Temp\1f9ce4a15d8b566fb37ebd6a0fe5751e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 116
  2⤵
  - Program crash
  PID:628

memory/1480-0-0x00000000002D0000-0x000000000033E000-memory.dmp

Filesize
440KB

Download