cf41cb79faae34503b4606e309da169819ab35533924db955a375089e074bca2

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 18:08

Target

334d02d11589c810655369022107bc8a.exe
Size

427KB
MD5

334d02d11589c810655369022107bc8a
SHA1

383833a323bfc5952d1e1b15a06affab55b9653d
SHA256

cf41cb79faae34503b4606e309da169819ab35533924db955a375089e074bca2
SHA512

fe35dc94d2e492fd754cdb3b33222fc79b27a4312f017232fe67de59621f446a1d158032b5912ad44f23f0f6664a45a026a5eaedc9d61c54258105feca92831f
SSDEEP

6144:aiFUvYoYDm5v8DJtBTd8dbVTh2adDWAzuroj3zjlYL1Q3R4:aigYLm5EDJtBJ8hrlurovhfR4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2312	2104	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2312	2104	334d02d11589c810655369022107bc8a.exe	14
PID 2104 wrote to memory of 2312	2104	334d02d11589c810655369022107bc8a.exe	14
PID 2104 wrote to memory of 2312	2104	334d02d11589c810655369022107bc8a.exe	14
PID 2104 wrote to memory of 2312	2104	334d02d11589c810655369022107bc8a.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 116
1⤵
- Program crash
PID:2312

C:\Users\Admin\AppData\Local\Temp\334d02d11589c810655369022107bc8a.exe
"C:\Users\Admin\AppData\Local\Temp\334d02d11589c810655369022107bc8a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104

memory/2104-0-0x0000000000AA0000-0x0000000000B0F000-memory.dmp

Filesize
444KB

Download