e30f40e15a54e382f9927c68d9dc3372d260409f396477e71f5992895ed55fba

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 14:12

Target

248438ab15b933bbd83dfa992e73439b.exe
Size

94KB
MD5

248438ab15b933bbd83dfa992e73439b
SHA1

41edbfa873da48ed6aadb9b4458621383590457d
SHA256

e30f40e15a54e382f9927c68d9dc3372d260409f396477e71f5992895ed55fba
SHA512

f9c6117ff129cc4e9201d7058023e4070f2818bba6877446cb35e7e10aca90d96580259b4a398959d19d065aa86a37679a9124a97dd0909085582a497ee13e34
SSDEEP

768:VEzQE2+b7B1T4t7vI2NiN+U4ZmTX7CaKf+ibj55VTQ1RBkMoas0Qz3FGnuYoEq:V235b7vkmVN+1e3c+ibV561RBhoB1Eq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2032	2080	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2032	2080	248438ab15b933bbd83dfa992e73439b.exe	14
PID 2080 wrote to memory of 2032	2080	248438ab15b933bbd83dfa992e73439b.exe	14
PID 2080 wrote to memory of 2032	2080	248438ab15b933bbd83dfa992e73439b.exe	14
PID 2080 wrote to memory of 2032	2080	248438ab15b933bbd83dfa992e73439b.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 92
1⤵
- Program crash
PID:2032

C:\Users\Admin\AppData\Local\Temp\248438ab15b933bbd83dfa992e73439b.exe
"C:\Users\Admin\AppData\Local\Temp\248438ab15b933bbd83dfa992e73439b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080

memory/2080-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download