a31eb1da6c15759fd914c32e543605f258464c9904ae3aeffadc6f0aaf09c966

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 13:56

Target

73c55d22729d5fb51e73b0e902164d14.exe
Size

504KB
MD5

73c55d22729d5fb51e73b0e902164d14
SHA1

0c0106469d1d208cdd3e25a13c3c72cfc3ec4dfc
SHA256

a31eb1da6c15759fd914c32e543605f258464c9904ae3aeffadc6f0aaf09c966
SHA512

f73cf0d011b1f7df51fef3141763749aecce38afaae2e444db54eed1e63c77c99220500a93b6619eb58d89f4531a7ac7108d181b76122e7145f1e3c384921952
SSDEEP

6144:0xfNDUr+DS9kZlVrtv35CPXbo92ynn8sbeWD2/bcjlLckc5CPXbo92ynnZlVrtvq:0tWrwvHRFbe7KAfFHRFbe73

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2244	2076	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2244	2076	73c55d22729d5fb51e73b0e902164d14.exe	28
PID 2076 wrote to memory of 2244	2076	73c55d22729d5fb51e73b0e902164d14.exe	28
PID 2076 wrote to memory of 2244	2076	73c55d22729d5fb51e73b0e902164d14.exe	28
PID 2076 wrote to memory of 2244	2076	73c55d22729d5fb51e73b0e902164d14.exe	28

C:\Users\Admin\AppData\Local\Temp\73c55d22729d5fb51e73b0e902164d14.exe
"C:\Users\Admin\AppData\Local\Temp\73c55d22729d5fb51e73b0e902164d14.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 140
  2⤵
  - Program crash
  PID:2244

memory/2076-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2076-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download