734bbec599216f12aae59d061c349ed08118712a9513dd54b277000201d8fed1

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 10:31

Target

67772c19061da2221edff48a94e69f3f.exe
Size

367KB
MD5

67772c19061da2221edff48a94e69f3f
SHA1

f19652af78ff6a11ddedb4bf4792886b8198aaf0
SHA256

734bbec599216f12aae59d061c349ed08118712a9513dd54b277000201d8fed1
SHA512

ade1b4b10337e2437fbf9cd5383c64799c7f78f76617103a34a9405cccb63c290f01c7a843684554967f2c5b228a527da7c6ed70b33d4e4b31862da80943f15f
SSDEEP

6144:211rg9/dHIm5gx8ISWIrPTka9ZhuGQT2+LwTdSv+qEMxpASjTnr:2c9/um5i8ISpkcxeAF4xpAST

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2092	2384	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2092	2384	67772c19061da2221edff48a94e69f3f.exe	14
PID 2384 wrote to memory of 2092	2384	67772c19061da2221edff48a94e69f3f.exe	14
PID 2384 wrote to memory of 2092	2384	67772c19061da2221edff48a94e69f3f.exe	14
PID 2384 wrote to memory of 2092	2384	67772c19061da2221edff48a94e69f3f.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 116
1⤵
- Program crash
PID:2092

C:\Users\Admin\AppData\Local\Temp\67772c19061da2221edff48a94e69f3f.exe
"C:\Users\Admin\AppData\Local\Temp\67772c19061da2221edff48a94e69f3f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2384

memory/2384-0-0x00000000000C0000-0x0000000000120000-memory.dmp

Filesize
384KB

Download