ee7d6d15812a27c12c49354ac04c8467e0135a192b44eaa676e9e56f1cb8466e

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 21:02

Target

3ca374274e2e33052c26f9296109d37e.exe
Size

321KB
MD5

3ca374274e2e33052c26f9296109d37e
SHA1

ebdd4d9f01cd95e504617ec7b2c49716d30cde9c
SHA256

ee7d6d15812a27c12c49354ac04c8467e0135a192b44eaa676e9e56f1cb8466e
SHA512

cc831a110f6d2bd3708fa311a900727e311688fc5fd8444ba712cde72efb8cfbc7f1f2452896c19d5c3ac0323b7b05f82a46775d51ff9367c50726e28d1a7252
SSDEEP

6144:OTj1OTEKnsub1upoH7td/tQqG56Prd3Z5NBA3r14lJDNIl:OFOoKnsub6oHprG5+3a7STY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
1572	1704	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1572	1704	3ca374274e2e33052c26f9296109d37e.exe	14
PID 1704 wrote to memory of 1572	1704	3ca374274e2e33052c26f9296109d37e.exe	14
PID 1704 wrote to memory of 1572	1704	3ca374274e2e33052c26f9296109d37e.exe	14
PID 1704 wrote to memory of 1572	1704	3ca374274e2e33052c26f9296109d37e.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 116
1⤵
- Program crash
PID:1572

C:\Users\Admin\AppData\Local\Temp\3ca374274e2e33052c26f9296109d37e.exe
"C:\Users\Admin\AppData\Local\Temp\3ca374274e2e33052c26f9296109d37e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704

memory/1704-0-0x0000000000280000-0x00000000002D5000-memory.dmp

Filesize
340KB

Download