073ce93363b5b5ec78d95f624995a51e97a98f3b8848e21667a189273cdff741

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 14:27

Target

2589ee5277e67c8e7a69790defa6e475.exe
Size

422KB
MD5

2589ee5277e67c8e7a69790defa6e475
SHA1

420384e5e744354b4636f903799d213bcde2945c
SHA256

073ce93363b5b5ec78d95f624995a51e97a98f3b8848e21667a189273cdff741
SHA512

b22c3ead960f09feb8a194364105d8293acbe70239a2e9639ea49ffa3d1bebaf1666e194348fc2e829a8cf2c8226db7bf698ba3e739f74e16ab08090624b34de
SSDEEP

6144:ykB1INZdWaFzaE7mDGg7Y4+MFyBPys80G5sEOi9Ri9na5UVx3:ykBgdW/E7mDGg8xMkBp80GiZa5UVh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1588	2408	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 1588	2408	2589ee5277e67c8e7a69790defa6e475.exe	28
PID 2408 wrote to memory of 1588	2408	2589ee5277e67c8e7a69790defa6e475.exe	28
PID 2408 wrote to memory of 1588	2408	2589ee5277e67c8e7a69790defa6e475.exe	28
PID 2408 wrote to memory of 1588	2408	2589ee5277e67c8e7a69790defa6e475.exe	28

C:\Users\Admin\AppData\Local\Temp\2589ee5277e67c8e7a69790defa6e475.exe
"C:\Users\Admin\AppData\Local\Temp\2589ee5277e67c8e7a69790defa6e475.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 116
  2⤵
  - Program crash
  PID:1588

memory/2408-0-0x0000000000CA0000-0x0000000000D0E000-memory.dmp

Filesize
440KB

Download