fa0dd74443676a1575f80adcbdac2bc5f7189d41885b71a5c3c66bb3f5b1217c

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 14:22

Target

754f4f84f6bbfa77b55bb3198282aa15.exe
Size

367KB
MD5

754f4f84f6bbfa77b55bb3198282aa15
SHA1

1b0332cb02ad22eb20e537e4385d5112fb65ba8c
SHA256

fa0dd74443676a1575f80adcbdac2bc5f7189d41885b71a5c3c66bb3f5b1217c
SHA512

b6baaffc67fc3b9813194d1d643006c46eaf99cc6f81188806ae3b11f7fc17b0fe20c31337d4f1187ab489297d57417144d0251b7ecfa205baa3d2e89a341449
SSDEEP

6144:rpEcAd/Mm5ZkyUneRTnJOmQ4W4/6zA5K0TzJRCp4xRvKUllD/W13+u:rTAOm5eyUnJmCzAXTzJR3RvK6lCwu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
796	1568	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 796	1568	754f4f84f6bbfa77b55bb3198282aa15.exe	14
PID 1568 wrote to memory of 796	1568	754f4f84f6bbfa77b55bb3198282aa15.exe	14
PID 1568 wrote to memory of 796	1568	754f4f84f6bbfa77b55bb3198282aa15.exe	14
PID 1568 wrote to memory of 796	1568	754f4f84f6bbfa77b55bb3198282aa15.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 116
1⤵
- Program crash
PID:796

C:\Users\Admin\AppData\Local\Temp\754f4f84f6bbfa77b55bb3198282aa15.exe
"C:\Users\Admin\AppData\Local\Temp\754f4f84f6bbfa77b55bb3198282aa15.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1568

memory/1568-0-0x00000000008E0000-0x0000000000940000-memory.dmp

Filesize
384KB

Download