05e985716e767fab956dc8d52a2a0eb2cf7945100c4299cdbe3ce35bc8c5caae

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 13:32

Target

21fa0dc1de6b75c056fc5e1df23e6994.exe
Size

323KB
MD5

21fa0dc1de6b75c056fc5e1df23e6994
SHA1

3889b13a5a7e8b7078462450427087747945d4b1
SHA256

05e985716e767fab956dc8d52a2a0eb2cf7945100c4299cdbe3ce35bc8c5caae
SHA512

0a85744b06908622a6553c7bab32b925841780c7b9e8d88dfb712e182a6da3c2506c941004f91746fbdafdc45c6cce128bece4f944bd7fe160ad65c9a29012d9
SSDEEP

6144:u2YV/ProBJQgalljd3rKzwN8Jlljd3njPX9ZAk3fs:u2YVXroTQtjpKXjtjP9Zt0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2988	2076	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2988	2076	21fa0dc1de6b75c056fc5e1df23e6994.exe	28
PID 2076 wrote to memory of 2988	2076	21fa0dc1de6b75c056fc5e1df23e6994.exe	28
PID 2076 wrote to memory of 2988	2076	21fa0dc1de6b75c056fc5e1df23e6994.exe	28
PID 2076 wrote to memory of 2988	2076	21fa0dc1de6b75c056fc5e1df23e6994.exe	28

C:\Users\Admin\AppData\Local\Temp\21fa0dc1de6b75c056fc5e1df23e6994.exe
"C:\Users\Admin\AppData\Local\Temp\21fa0dc1de6b75c056fc5e1df23e6994.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 140
  2⤵
  - Program crash
  PID:2988

memory/2076-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2076-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download