ed47736d7340e18e3a443628aeb3cc08f9cf4d36ed32ba2715c86212b72747b8

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 16:56

Target

2ee0c98a2ad2be9d20fed77d5d981462.exe
Size

170KB
MD5

2ee0c98a2ad2be9d20fed77d5d981462
SHA1

4ca5a3d5905b22d9954a0d661d6e798558d05a19
SHA256

ed47736d7340e18e3a443628aeb3cc08f9cf4d36ed32ba2715c86212b72747b8
SHA512

5fe81abec50f0460a2fcfc1da2852a639a4b66c59942c901f21d4d702755652fb65a1f5e4197633fbcedf76d45adee1ef8c5e790cac1c73a1a1e806c96cf567c
SSDEEP

3072:42N3p7dXIPEq7OtTBfl8x81mfHA3nHEFN3hH/BrdeU1J1nD:h/IPf7OtTBgzYkFb1sUlD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1736	2628	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 1736	2628	2ee0c98a2ad2be9d20fed77d5d981462.exe	28
PID 2628 wrote to memory of 1736	2628	2ee0c98a2ad2be9d20fed77d5d981462.exe	28
PID 2628 wrote to memory of 1736	2628	2ee0c98a2ad2be9d20fed77d5d981462.exe	28
PID 2628 wrote to memory of 1736	2628	2ee0c98a2ad2be9d20fed77d5d981462.exe	28

C:\Users\Admin\AppData\Local\Temp\2ee0c98a2ad2be9d20fed77d5d981462.exe
"C:\Users\Admin\AppData\Local\Temp\2ee0c98a2ad2be9d20fed77d5d981462.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 88
  2⤵
  - Program crash
  PID:1736