c4f296f8598d581d264af85ed1af8b17a78a3664dcfd3a4c2345d93c578dab8b

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 10:55

Target

68fabac1f641e18d6a1f49d2e9ac9b0a.exe
Size

321KB
MD5

68fabac1f641e18d6a1f49d2e9ac9b0a
SHA1

3a925e3a6065837b1b28e5ab826a81830aba8de2
SHA256

c4f296f8598d581d264af85ed1af8b17a78a3664dcfd3a4c2345d93c578dab8b
SHA512

cb35a8b073ce2d2a460772a3ef22f89c9bde2eec50b343edf878955cdc85d7d6c38fd2e71bbdee8e8b178f297ee432ecb8d66557d9baebb0532669669ec9582a
SSDEEP

6144:OTj1OTEKnsub1upoH7td/tQqG56Prd3Z5NBA3r14lJDNIl:OFOoKnsub6oHprG5+3a7STY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2220	2360	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2220	2360	68fabac1f641e18d6a1f49d2e9ac9b0a.exe	16
PID 2360 wrote to memory of 2220	2360	68fabac1f641e18d6a1f49d2e9ac9b0a.exe	16
PID 2360 wrote to memory of 2220	2360	68fabac1f641e18d6a1f49d2e9ac9b0a.exe	16
PID 2360 wrote to memory of 2220	2360	68fabac1f641e18d6a1f49d2e9ac9b0a.exe	16

C:\Users\Admin\AppData\Local\Temp\68fabac1f641e18d6a1f49d2e9ac9b0a.exe
"C:\Users\Admin\AppData\Local\Temp\68fabac1f641e18d6a1f49d2e9ac9b0a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 116
  2⤵
  - Program crash
  PID:2220

memory/2360-0-0x00000000013C0000-0x0000000001415000-memory.dmp

Filesize
340KB

Download