65cc38d50854239cd812e8f4b38f6e9b9f0e3444c750a34fef6f48839633080c

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 17:12

Target

2febd4929d943d54d2d9a7c1d3ea0af9.exe
Size

55KB
MD5

2febd4929d943d54d2d9a7c1d3ea0af9
SHA1

6ca4cd9135ffb4c1e2169b1589a3950ee44c2e6b
SHA256

65cc38d50854239cd812e8f4b38f6e9b9f0e3444c750a34fef6f48839633080c
SHA512

2083c792e63dafb5a6e6737374cb90192aa10a4daca8785b83ab15de7f918ae1619816d55e02cb1df9781200db31075da27ab94f5bdd6313eb46adc957f6dd6e
SSDEEP

768:6Yy9R5qYpt6wFlTYceUVTZjQjNCSvgAVTKoRd1IfQlcXh2p/1H5pXdnh:3y9R5Fv+YGNDvgAVTKoRd8bh2LF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2996	2932	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2996	2932	2febd4929d943d54d2d9a7c1d3ea0af9.exe	16
PID 2932 wrote to memory of 2996	2932	2febd4929d943d54d2d9a7c1d3ea0af9.exe	16
PID 2932 wrote to memory of 2996	2932	2febd4929d943d54d2d9a7c1d3ea0af9.exe	16
PID 2932 wrote to memory of 2996	2932	2febd4929d943d54d2d9a7c1d3ea0af9.exe	16

C:\Users\Admin\AppData\Local\Temp\2febd4929d943d54d2d9a7c1d3ea0af9.exe
"C:\Users\Admin\AppData\Local\Temp\2febd4929d943d54d2d9a7c1d3ea0af9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 140
  2⤵
  - Program crash
  PID:2996

memory/2932-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download