bcb168e7fbd12c4b83c74d54ba4d9d63dfa3956c7d71c568be2b5147c4d5c867

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:09

Target

1d2b184d91a695c9505a82b35c34f967.exe
Size

430KB
MD5

1d2b184d91a695c9505a82b35c34f967
SHA1

ba114031d2fed1c54fc6a9ffaad6ab29976335c7
SHA256

bcb168e7fbd12c4b83c74d54ba4d9d63dfa3956c7d71c568be2b5147c4d5c867
SHA512

01bc6c91e214d1a6b24a59594d43a2b6e6b41148ad45758370337911e71ecf68b44c5f8f41f481c8364d1c828efee94f148019d85d1589c0ac9ce0aa4762cb5f
SSDEEP

6144:mYbWW2WDmyUUqK5EhEMDMg48Td50WKtNvGRNxw8QUjw:mhWjmyUUqK5j030TyNC8Q5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2032	3028	WerFault.exe	3

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2032	3028	1d2b184d91a695c9505a82b35c34f967.exe	20
PID 3028 wrote to memory of 2032	3028	1d2b184d91a695c9505a82b35c34f967.exe	20
PID 3028 wrote to memory of 2032	3028	1d2b184d91a695c9505a82b35c34f967.exe	20
PID 3028 wrote to memory of 2032	3028	1d2b184d91a695c9505a82b35c34f967.exe	20

C:\Users\Admin\AppData\Local\Temp\1d2b184d91a695c9505a82b35c34f967.exe
"C:\Users\Admin\AppData\Local\Temp\1d2b184d91a695c9505a82b35c34f967.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 116
  2⤵
  - Program crash
  PID:2032

memory/3028-0-0x00000000012D0000-0x0000000001340000-memory.dmp

Filesize
448KB

Download