e6caef6fab6e87b59fc8cc91fed13248d3d76f14f871f1fb5b046827caa89abb

Analysis

max time kernel
142s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 18:11

Target

3384b2fba1a008212d070a43fce97ca3.exe
Size

224KB
MD5

3384b2fba1a008212d070a43fce97ca3
SHA1

3dcf738589de8e16e64babd61e2cb98084091f9f
SHA256

e6caef6fab6e87b59fc8cc91fed13248d3d76f14f871f1fb5b046827caa89abb
SHA512

d964c0ffe9e81e5941b9c813cfffe24dfc128fb89bb4e2a2beb5039e32984ba85fdc264eb5dbd659d8799b6ce11f20b780509615401a2e79e4c2f247f0eb1e07
SSDEEP

3072:aRQ7CXW+UL46p1sKFKQcCix1CNZK7hS9uo4Kq8lRJ/lDNjNXPaCdZd4O4Br4cgL:L7CQz43Ci7CLqIJqOndD/facd4Br5E

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
620	1888	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 620	1888	3384b2fba1a008212d070a43fce97ca3.exe	28
PID 1888 wrote to memory of 620	1888	3384b2fba1a008212d070a43fce97ca3.exe	28
PID 1888 wrote to memory of 620	1888	3384b2fba1a008212d070a43fce97ca3.exe	28
PID 1888 wrote to memory of 620	1888	3384b2fba1a008212d070a43fce97ca3.exe	28

C:\Users\Admin\AppData\Local\Temp\3384b2fba1a008212d070a43fce97ca3.exe
"C:\Users\Admin\AppData\Local\Temp\3384b2fba1a008212d070a43fce97ca3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 88
  2⤵
  - Program crash
  PID:620

memory/1888-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download