a4bad6739f7fae953e3c05dbfaa91c0b7211aa21b08a192c0d09e0d94af6f22d

Analysis

max time kernel
67s
max time network
27s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 17:05

Target

2f7af2cfd99713d97a5d99c975d63874.exe
Size

487KB
MD5

2f7af2cfd99713d97a5d99c975d63874
SHA1

7c96da6e65d8234e78a306d446c8f805925d5e6b
SHA256

a4bad6739f7fae953e3c05dbfaa91c0b7211aa21b08a192c0d09e0d94af6f22d
SHA512

c223e0e1e3b4cf9952ffd3749c18afa29929f4eaf4b94460a3089c237e899d3e3591162aac5c69792894779bae1f479ff1235a41db530c5942208dd79b429594
SSDEEP

12288:IvOos7XPOkGFQ/ujd+GMv9OaVsU86EM4ShhIAO:IvOZ7nGm/Yd+GM1aL6EM3htO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2640	2572	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 2640	2572	2f7af2cfd99713d97a5d99c975d63874.exe	28
PID 2572 wrote to memory of 2640	2572	2f7af2cfd99713d97a5d99c975d63874.exe	28
PID 2572 wrote to memory of 2640	2572	2f7af2cfd99713d97a5d99c975d63874.exe	28
PID 2572 wrote to memory of 2640	2572	2f7af2cfd99713d97a5d99c975d63874.exe	28

C:\Users\Admin\AppData\Local\Temp\2f7af2cfd99713d97a5d99c975d63874.exe
"C:\Users\Admin\AppData\Local\Temp\2f7af2cfd99713d97a5d99c975d63874.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 116
  2⤵
  - Program crash
  PID:2640

memory/2572-0-0x0000000001040000-0x00000000010BE000-memory.dmp

Filesize
504KB

Download