608f4c39cb112d7d803cae9658661b970dc9e6b4177fcfd7a2bc1333b050aa12

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 13:11

Target

20c3630772b502875b11822d2b344175.exe
Size

20KB
MD5

20c3630772b502875b11822d2b344175
SHA1

50b9782ed12553a3e6c0949837c0b8485ca5becb
SHA256

608f4c39cb112d7d803cae9658661b970dc9e6b4177fcfd7a2bc1333b050aa12
SHA512

3aeead6e1a73dda6818c0e2e758650dd57fca0f76449ff87373da7bec8b508f3a319bc7db63d125c1a5148dd09b996706574554730fd251662c5460f3cf1f8c2
SSDEEP

96:5l3WDSHatgyOp4jMB4Nal6d18aaLUGOhECShB0GSQflZJYWINKq:5tCisa0d1ZEOhKBmwlZJtII

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3052	2688	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 3052	2688	20c3630772b502875b11822d2b344175.exe	28
PID 2688 wrote to memory of 3052	2688	20c3630772b502875b11822d2b344175.exe	28
PID 2688 wrote to memory of 3052	2688	20c3630772b502875b11822d2b344175.exe	28
PID 2688 wrote to memory of 3052	2688	20c3630772b502875b11822d2b344175.exe	28

C:\Users\Admin\AppData\Local\Temp\20c3630772b502875b11822d2b344175.exe
"C:\Users\Admin\AppData\Local\Temp\20c3630772b502875b11822d2b344175.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 88
  2⤵
  - Program crash
  PID:3052

memory/2688-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download