c268df0c950482ce6e5c26f911357b499a31c3e29b01af016d6146d7648b3030

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 12:11

Target

1d486c903c3df6a06dd44074ca4fa5f4.exe
Size

370KB
MD5

1d486c903c3df6a06dd44074ca4fa5f4
SHA1

939b5c0bf71332f0aa527fd36e614683ccf840fb
SHA256

c268df0c950482ce6e5c26f911357b499a31c3e29b01af016d6146d7648b3030
SHA512

124e220e9c7e704594ffa5b290873bc61d161f385cbb7513e753716343633a5b3c2ac63acf2abc5049b84c7004bb6e005b8ae6594053a83a3da326dd93c86791
SSDEEP

6144:7MbHzAp5A+/tDK252N7JYhGbBU/hgzmApsGPzdJxq4KjWM9bYv+:4DzAzl1DK252N1FsgzmAp/s4OWM9bw+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2932	2928	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2932	2928	1d486c903c3df6a06dd44074ca4fa5f4.exe	28
PID 2928 wrote to memory of 2932	2928	1d486c903c3df6a06dd44074ca4fa5f4.exe	28
PID 2928 wrote to memory of 2932	2928	1d486c903c3df6a06dd44074ca4fa5f4.exe	28
PID 2928 wrote to memory of 2932	2928	1d486c903c3df6a06dd44074ca4fa5f4.exe	28

C:\Users\Admin\AppData\Local\Temp\1d486c903c3df6a06dd44074ca4fa5f4.exe
"C:\Users\Admin\AppData\Local\Temp\1d486c903c3df6a06dd44074ca4fa5f4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 36
  2⤵
  - Program crash
  PID:2932

memory/2928-0-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download
memory/2928-1-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download