73e1d28f7569872eec85ea0921993db16c5ca66738a8e4ccb94e54a5fc5d73aa

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:38

Target

1f09b758dcb609c97e8e32947a4bc7d3.exe
Size

94KB
MD5

1f09b758dcb609c97e8e32947a4bc7d3
SHA1

7f742347b692a9d18d2b81da4cf25f13d505120c
SHA256

73e1d28f7569872eec85ea0921993db16c5ca66738a8e4ccb94e54a5fc5d73aa
SHA512

dd4b81a47a0c93ba7745f6752b42980d0a646c6b38f25e4acd84aa65ee310f229d2c624da521d1587b08e29e26fc7a932fe95c61990570113f46dd047f939db7
SSDEEP

1536:JbKfD4HH4nydWZKI6g7wzGu2QBIQ2fP+ypRhw2nhV/MTVD+Uh6B:JbKc4nydZo0zGu2QeQm+E7znP6CU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2208	2172	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2208	2172	1f09b758dcb609c97e8e32947a4bc7d3.exe	28
PID 2172 wrote to memory of 2208	2172	1f09b758dcb609c97e8e32947a4bc7d3.exe	28
PID 2172 wrote to memory of 2208	2172	1f09b758dcb609c97e8e32947a4bc7d3.exe	28
PID 2172 wrote to memory of 2208	2172	1f09b758dcb609c97e8e32947a4bc7d3.exe	28

C:\Users\Admin\AppData\Local\Temp\1f09b758dcb609c97e8e32947a4bc7d3.exe
"C:\Users\Admin\AppData\Local\Temp\1f09b758dcb609c97e8e32947a4bc7d3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 64
  2⤵
  - Program crash
  PID:2208