ff1f9707b0ef8377f805ecc1ddf2be408fe027c3bb201467d4929612d196265d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:55

Target

201d61a94cd135ea622098866581dcc4.exe
Size

430KB
MD5

201d61a94cd135ea622098866581dcc4
SHA1

3b5241eccf48cd63ca8c7b7a101474ee6bbac59e
SHA256

ff1f9707b0ef8377f805ecc1ddf2be408fe027c3bb201467d4929612d196265d
SHA512

7071bc137db765fa99de2f992081b7474010faa758ca12502c2ab31074d68016e5df2fb5fd9f121ee4a3a7ca6c2301c79d249ac6a500d22f8f13e9ba66c9861a
SSDEEP

6144:Ulsy4TNbEm1B1zzqaCh9Ju/2x+vw0b8ajNglS2+gUXpP9YC4r:UdwNIm1B1zzqrh9Jf+btwSfgUnBI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2232	2240	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2232	2240	201d61a94cd135ea622098866581dcc4.exe	16
PID 2240 wrote to memory of 2232	2240	201d61a94cd135ea622098866581dcc4.exe	16
PID 2240 wrote to memory of 2232	2240	201d61a94cd135ea622098866581dcc4.exe	16
PID 2240 wrote to memory of 2232	2240	201d61a94cd135ea622098866581dcc4.exe	16

C:\Users\Admin\AppData\Local\Temp\201d61a94cd135ea622098866581dcc4.exe
"C:\Users\Admin\AppData\Local\Temp\201d61a94cd135ea622098866581dcc4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 116
  2⤵
  - Program crash
  PID:2232

memory/2240-0-0x0000000000F70000-0x0000000000FE0000-memory.dmp

Filesize
448KB

Download