54a79cfabd2d6a3f6471351d33ca3764858301c01a9e239826d002673cac3a0d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 10:38

Target

67ee8ed5f2f749def3df2a4b6410d7cd.exe
Size

636KB
MD5

67ee8ed5f2f749def3df2a4b6410d7cd
SHA1

817d0c5678df4167b604890e0fbcecde40569f00
SHA256

54a79cfabd2d6a3f6471351d33ca3764858301c01a9e239826d002673cac3a0d
SHA512

f4ccb3440f6b6e6c38f81db5d914886b2278871594921b8f4721d4ff54ca4eb9325a62dd919f24b0a00ef0b05561d478fb70324098a089abc611d9b02238a5cd
SSDEEP

12288:VohjbbHOY5c9CsDrgMLiMuf8nbtYLPsfEHlWs9ap:Voh/bHOY5c9CsHnuYx+kclEp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1704	824	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 1704	824	67ee8ed5f2f749def3df2a4b6410d7cd.exe	16
PID 824 wrote to memory of 1704	824	67ee8ed5f2f749def3df2a4b6410d7cd.exe	16
PID 824 wrote to memory of 1704	824	67ee8ed5f2f749def3df2a4b6410d7cd.exe	16
PID 824 wrote to memory of 1704	824	67ee8ed5f2f749def3df2a4b6410d7cd.exe	16

C:\Users\Admin\AppData\Local\Temp\67ee8ed5f2f749def3df2a4b6410d7cd.exe
"C:\Users\Admin\AppData\Local\Temp\67ee8ed5f2f749def3df2a4b6410d7cd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 164
  2⤵
  - Program crash
  PID:1704

memory/824-0-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/824-1-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download