75f0eb813491e5cd7fdfceeb6efd4769304484d14a3cc51b84bc9d4069d5a511

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 17:45

Target

31ee3c91e3648622ec5ee81a9fc1161e.exe
Size

61KB
MD5

31ee3c91e3648622ec5ee81a9fc1161e
SHA1

6f7e1c05369c41f95cf9417ed90513335d8c5393
SHA256

75f0eb813491e5cd7fdfceeb6efd4769304484d14a3cc51b84bc9d4069d5a511
SHA512

2bddabc7deec56abb00235fd3b6ac3224d8fa87fe22624cabbd54ff81ca9c68b87cfb4bc7af31988b85452395d0e0ddc167db4ff3bae44fe648d7a7a7c1d3616
SSDEEP

768:wR4KNw36I2yXhXWzovu4+LgWo+5PXaxeqZOqU1azziamIsx+Q96vvU8LolVheJET:v0wKTnSAD5yxdZOqVEQ0heCKsz1UM3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1928	1896	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 1928	1896	31ee3c91e3648622ec5ee81a9fc1161e.exe	28
PID 1896 wrote to memory of 1928	1896	31ee3c91e3648622ec5ee81a9fc1161e.exe	28
PID 1896 wrote to memory of 1928	1896	31ee3c91e3648622ec5ee81a9fc1161e.exe	28
PID 1896 wrote to memory of 1928	1896	31ee3c91e3648622ec5ee81a9fc1161e.exe	28

C:\Users\Admin\AppData\Local\Temp\31ee3c91e3648622ec5ee81a9fc1161e.exe
"C:\Users\Admin\AppData\Local\Temp\31ee3c91e3648622ec5ee81a9fc1161e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 96
  2⤵
  - Program crash
  PID:1928

memory/1896-0-0x00000000001B0000-0x00000000001BF000-memory.dmp

Filesize
60KB

Download
memory/1896-1-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download