129aed18b2c9b6047f0f788bc970fdd6e36491b4a82a9d2eda56f1aed4da2b33

Analysis

max time kernel
16s
max time network
27s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 14:35

Target

260e060ed8f80851b2cb541533806c06.exe
Size

893KB
MD5

260e060ed8f80851b2cb541533806c06
SHA1

4cfbc1b652b90c503a502142a43adf412ba3c42a
SHA256

129aed18b2c9b6047f0f788bc970fdd6e36491b4a82a9d2eda56f1aed4da2b33
SHA512

6651e26bd897b3c0b91af8ea3dd6dd3a7c3946ed36761dbb25bdc0303aa504551125e1209cf2e41befa08750f7bf02f7cb1d8b8581e8d2cd55ac4bf618fe6e24
SSDEEP

12288:9WFMoIQQhWUwAY1aXHj8C1OLN05I9T87An8XaxETVYSfo9TxHkSusvkkVXJYg8n7:Yp3lUwAJwoe94excYSw9Tqsv1P8Y2b1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2476	2064	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2476	2064	260e060ed8f80851b2cb541533806c06.exe	28
PID 2064 wrote to memory of 2476	2064	260e060ed8f80851b2cb541533806c06.exe	28
PID 2064 wrote to memory of 2476	2064	260e060ed8f80851b2cb541533806c06.exe	28
PID 2064 wrote to memory of 2476	2064	260e060ed8f80851b2cb541533806c06.exe	28

C:\Users\Admin\AppData\Local\Temp\260e060ed8f80851b2cb541533806c06.exe
"C:\Users\Admin\AppData\Local\Temp\260e060ed8f80851b2cb541533806c06.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 160
  2⤵
  - Program crash
  PID:2476

memory/2064-0-0x0000000000D90000-0x0000000000E49000-memory.dmp

Filesize
740KB

Download