a2c1f29ef64f98db4b4ce6d79fea1b6c07b434d65492835944a56d91c92d6727

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 17:08

Target

2fae9a6ada6d56f5f98516834030e0fe.exe
Size

693KB
MD5

2fae9a6ada6d56f5f98516834030e0fe
SHA1

1ad4d9772ef02e689255624a12e4f79371d9acbb
SHA256

a2c1f29ef64f98db4b4ce6d79fea1b6c07b434d65492835944a56d91c92d6727
SHA512

fb4bac94990bbf6bf084296d8609c8235db84b37595b3b2d53d34afe29443aa4bb323a43032fb024fe6e86bb1f3ea4f9a8dbc85057693ac61c0b34094f8e19f1
SSDEEP

12288:MSzy9G8iPK1eTOpVUnto2UiBRXjIj35HGTO+2aS2Vm9+Cu:MSzFKUTOpVjx8RQHGvW9m

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1244	1936	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1244	1936	2fae9a6ada6d56f5f98516834030e0fe.exe	28
PID 1936 wrote to memory of 1244	1936	2fae9a6ada6d56f5f98516834030e0fe.exe	28
PID 1936 wrote to memory of 1244	1936	2fae9a6ada6d56f5f98516834030e0fe.exe	28
PID 1936 wrote to memory of 1244	1936	2fae9a6ada6d56f5f98516834030e0fe.exe	28

C:\Users\Admin\AppData\Local\Temp\2fae9a6ada6d56f5f98516834030e0fe.exe
"C:\Users\Admin\AppData\Local\Temp\2fae9a6ada6d56f5f98516834030e0fe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 132
  2⤵
  - Program crash
  PID:1244

memory/1936-0-0x0000000000F40000-0x0000000000FF2000-memory.dmp

Filesize
712KB

Download