f82a534c7b32fcaa056f436244626ef2d3d19b8801c034b253b611d8dfe86b0c

Analysis

max time kernel
120s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 16:56

Target

2eeae763d115860f3adef65ab1f1dfa3.exe
Size

336KB
MD5

2eeae763d115860f3adef65ab1f1dfa3
SHA1

e716bf5c8125cec349309603b90820341bb7f540
SHA256

f82a534c7b32fcaa056f436244626ef2d3d19b8801c034b253b611d8dfe86b0c
SHA512

c6d0b0017b14a55177bf9efa77e45658ae7362ec335c0a448555f34f3dc9b69835f1522cd638c3703edeb615144539191702790323fab66a39d0608a3bd235c5
SSDEEP

3072:Ge0MfPWNk8qOdYcP5zE6EBvakjBTfoSSdo/gJCjlVW0i1YlQst+dlj3H8WPYhOAg:GQ+pFVt6dj3kWmxlq4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	1868	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2224	1868	2eeae763d115860f3adef65ab1f1dfa3.exe	16
PID 1868 wrote to memory of 2224	1868	2eeae763d115860f3adef65ab1f1dfa3.exe	16
PID 1868 wrote to memory of 2224	1868	2eeae763d115860f3adef65ab1f1dfa3.exe	16
PID 1868 wrote to memory of 2224	1868	2eeae763d115860f3adef65ab1f1dfa3.exe	16

C:\Users\Admin\AppData\Local\Temp\2eeae763d115860f3adef65ab1f1dfa3.exe
"C:\Users\Admin\AppData\Local\Temp\2eeae763d115860f3adef65ab1f1dfa3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 148
  2⤵
  - Program crash
  PID:2224