f01d2c5aebf46bdef53a7352f8c7f3f7e3a4b4b44c3a059a7b361873830da9d3

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 10:50

Target

68be3156570181b687a2c673f5b094db.exe
Size

76KB
MD5

68be3156570181b687a2c673f5b094db
SHA1

6bef3ac5ba1e8dcfe6b30a32293e93952ec87322
SHA256

f01d2c5aebf46bdef53a7352f8c7f3f7e3a4b4b44c3a059a7b361873830da9d3
SHA512

c8f64a2b61bfa72a560dbccb10dc178098df86943aa530825ac4575c3f941f32f4f97dd7ffd680b8d9f43bd508ca29ae52cbe6423b23bf616eacc6eb1a313b51
SSDEEP

1536:m/ePyXHZ7DA4BfBrmTiXvvvUgbFNCuACP1DIgN:EeSHZ7DTBfBrB/UgbFNCuAq2C

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
1848	2368	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1848	2368	68be3156570181b687a2c673f5b094db.exe	16
PID 2368 wrote to memory of 1848	2368	68be3156570181b687a2c673f5b094db.exe	16
PID 2368 wrote to memory of 1848	2368	68be3156570181b687a2c673f5b094db.exe	16
PID 2368 wrote to memory of 1848	2368	68be3156570181b687a2c673f5b094db.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 108
1⤵
- Program crash
PID:1848

C:\Users\Admin\AppData\Local\Temp\68be3156570181b687a2c673f5b094db.exe
"C:\Users\Admin\AppData\Local\Temp\68be3156570181b687a2c673f5b094db.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2368

memory/2368-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2368-1-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download