d2f2111e41282638738a99eb75d927a4f7a16482cb0f462d466446fe425fdec6

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 13:31

Target

21e6cbee73432dc4061a30993f007d7d.exe
Size

321KB
MD5

21e6cbee73432dc4061a30993f007d7d
SHA1

aeca261893e06634e82a90c33c6081b6cb17da2d
SHA256

d2f2111e41282638738a99eb75d927a4f7a16482cb0f462d466446fe425fdec6
SHA512

a865034cee468514aa41907bf6a708d0981bf0b9b7c6f801d317f0c151beb8f12baf4e0c548075b6358c06d6d8c09025c04df6f538149cdb61ff1e1aeae0168c
SSDEEP

6144:OTj1OTEKnsub1upoH7td/tQqG56Prd3Z5NBA3r14lJDNIl:OFOoKnsub6oHprG5+3a7STY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3032	2928	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 3032	2928	21e6cbee73432dc4061a30993f007d7d.exe	28
PID 2928 wrote to memory of 3032	2928	21e6cbee73432dc4061a30993f007d7d.exe	28
PID 2928 wrote to memory of 3032	2928	21e6cbee73432dc4061a30993f007d7d.exe	28
PID 2928 wrote to memory of 3032	2928	21e6cbee73432dc4061a30993f007d7d.exe	28

C:\Users\Admin\AppData\Local\Temp\21e6cbee73432dc4061a30993f007d7d.exe
"C:\Users\Admin\AppData\Local\Temp\21e6cbee73432dc4061a30993f007d7d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 116
  2⤵
  - Program crash
  PID:3032

memory/2928-0-0x0000000001160000-0x00000000011B5000-memory.dmp

Filesize
340KB

Download