212e66b7c8dba7ae19d811cc78f021f6c0370151c0ba5140f59877a1c5a75967

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 17:37

Target

31731dc5728d07ceb17ea2c662dd7592.exe
Size

3.5MB
MD5

31731dc5728d07ceb17ea2c662dd7592
SHA1

2da4a4d99eb11754f3972c4cdf8af2a094060df5
SHA256

212e66b7c8dba7ae19d811cc78f021f6c0370151c0ba5140f59877a1c5a75967
SHA512

6d496f2d5dd1811c1b8a16880d6eec2b8c7a673843aa4b532994d3e67fc3e2bc0257a0baa6332454344aae7b257d28eb77d32b89117355906c43ab9fb2f2d759
SSDEEP

49152:YN+J39Gh1e+K3l5TFoCIJQT+rUlSV2e07tE0SM3Qpkexre6PBh4OX3a092ZAj:rMPe1ZvwhYfO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2508	832	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 2508	832	31731dc5728d07ceb17ea2c662dd7592.exe	28
PID 832 wrote to memory of 2508	832	31731dc5728d07ceb17ea2c662dd7592.exe	28
PID 832 wrote to memory of 2508	832	31731dc5728d07ceb17ea2c662dd7592.exe	28
PID 832 wrote to memory of 2508	832	31731dc5728d07ceb17ea2c662dd7592.exe	28

C:\Users\Admin\AppData\Local\Temp\31731dc5728d07ceb17ea2c662dd7592.exe
"C:\Users\Admin\AppData\Local\Temp\31731dc5728d07ceb17ea2c662dd7592.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 116
  2⤵
  - Program crash
  PID:2508

memory/832-0-0x0000000000300000-0x0000000000363000-memory.dmp

Filesize
396KB

Download