8172a6faec609addf0bf63a87b52dff0f638aa11d0f3676ad8fe431b62271a2c

Analysis

max time kernel
122s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 09:35

Target

644073bd6d88506db27f09293f8b269b.exe
Size

716KB
MD5

644073bd6d88506db27f09293f8b269b
SHA1

8b60e42f080cf00e0182dcb3fed45d2aaedd8d99
SHA256

8172a6faec609addf0bf63a87b52dff0f638aa11d0f3676ad8fe431b62271a2c
SHA512

db4f212cb1307f200dc2895f23fce88a2fb58287206bf8cab3adc1979ec91d04ed369cd1778cfbe4df3ea96b4fa5f6694fe8113ce21855e57d99ac627c4ca90c
SSDEEP

12288:PkFDob8apwzzU/KoV534/SYNVbY/2ToCfD4cxDnz1BhhP9bEIVQq183ewyxodLko:cF8Qzwic4SgY/EfMctbh9RBo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1160	1736	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1160	1736	644073bd6d88506db27f09293f8b269b.exe	16
PID 1736 wrote to memory of 1160	1736	644073bd6d88506db27f09293f8b269b.exe	16
PID 1736 wrote to memory of 1160	1736	644073bd6d88506db27f09293f8b269b.exe	16
PID 1736 wrote to memory of 1160	1736	644073bd6d88506db27f09293f8b269b.exe	16

C:\Users\Admin\AppData\Local\Temp\644073bd6d88506db27f09293f8b269b.exe
"C:\Users\Admin\AppData\Local\Temp\644073bd6d88506db27f09293f8b269b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 36
  2⤵
  - Program crash
  PID:1160

memory/1736-0-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1736-1-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download