e4b8b3a5ccd60aa36244b7bf69c95309c511f678845b0a35acc7a7a25bcad08a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 15:07

Target

2811878ce326b5c4baa0cbc2950136de.exe
Size

280KB
MD5

2811878ce326b5c4baa0cbc2950136de
SHA1

6f04112074054b76cf35f1eb7e7e8dc778a0ac33
SHA256

e4b8b3a5ccd60aa36244b7bf69c95309c511f678845b0a35acc7a7a25bcad08a
SHA512

2db2894f21d7247b6c116c08ad5d501759c377b5f58cc5f9c20e17b0bba07af26ab7e28718387d8d8ec535047e3fbc4237431ebd03ae10f06c243aa67937ca0c
SSDEEP

3072:noWNvn+CsyERIlodeuhzBhVf+qPWaSXmmxumYAyRo0b5l9NEDHH7Po5gs4+Xxns2:nBR0RIlkh3VGRaSXBJYk0h+U1BbN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
912	2408	WerFault.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 912	2408	2811878ce326b5c4baa0cbc2950136de.exe	16
PID 2408 wrote to memory of 912	2408	2811878ce326b5c4baa0cbc2950136de.exe	16
PID 2408 wrote to memory of 912	2408	2811878ce326b5c4baa0cbc2950136de.exe	16
PID 2408 wrote to memory of 912	2408	2811878ce326b5c4baa0cbc2950136de.exe	16
PID 2408 wrote to memory of 912	2408	2811878ce326b5c4baa0cbc2950136de.exe	16
PID 2408 wrote to memory of 912	2408	2811878ce326b5c4baa0cbc2950136de.exe	16
PID 2408 wrote to memory of 912	2408	2811878ce326b5c4baa0cbc2950136de.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 252
1⤵
- Program crash
PID:912

C:\Users\Admin\AppData\Local\Temp\2811878ce326b5c4baa0cbc2950136de.exe
"C:\Users\Admin\AppData\Local\Temp\2811878ce326b5c4baa0cbc2950136de.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2408

memory/2408-1-0x0000000000240000-0x0000000000288000-memory.dmp

Filesize
288KB

Download
memory/2408-0-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download