e529d736eb5d661cbdc62f88f50461d736686bb2aa31fb28a5412d59e4c81bc4

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/12/2023, 08:52

Target

ab425bf1f9965f054ee0400007e4c28a.exe
Size

1.1MB
MD5

ab425bf1f9965f054ee0400007e4c28a
SHA1

10c79c14e1e050ff2fb14d4d3470b763a7c2c541
SHA256

e529d736eb5d661cbdc62f88f50461d736686bb2aa31fb28a5412d59e4c81bc4
SHA512

cc6159fe281aab2a5c9bbaa91feb4844e630bd37434bd96a7811155a7ebbb9ef801c959b3bf874b9275d7dba3a97f41e0804040fa77bedc835d4e12c0e0d625e
SSDEEP

12288:2oKboJfbmpMC3y50ysABr54bCRPZr5ZU0ZG+wksmB4C:2oKAfipMCC2dABtRRNnwFC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1940	2304	WerFault.exe	15

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 1792	2304	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 2304 wrote to memory of 1792	2304	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 2304 wrote to memory of 1792	2304	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 2304 wrote to memory of 1792	2304	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 2304 wrote to memory of 1792	2304	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 2304 wrote to memory of 1792	2304	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 2304 wrote to memory of 1792	2304	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 2304 wrote to memory of 1792	2304	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 2304 wrote to memory of 1792	2304	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 2304 wrote to memory of 1792	2304	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 2304 wrote to memory of 1792	2304	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 2304 wrote to memory of 1792	2304	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 2304 wrote to memory of 1792	2304	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 2304 wrote to memory of 1940	2304	ab425bf1f9965f054ee0400007e4c28a.exe	31
PID 2304 wrote to memory of 1940	2304	ab425bf1f9965f054ee0400007e4c28a.exe	31
PID 2304 wrote to memory of 1940	2304	ab425bf1f9965f054ee0400007e4c28a.exe	31
PID 2304 wrote to memory of 1940	2304	ab425bf1f9965f054ee0400007e4c28a.exe	31

C:\Users\Admin\AppData\Local\Temp\ab425bf1f9965f054ee0400007e4c28a.exe
"C:\Users\Admin\AppData\Local\Temp\ab425bf1f9965f054ee0400007e4c28a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  2⤵
  PID:1792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 1776
  2⤵
  - Program crash
  PID:1940

memory/2304-0-0x0000000000990000-0x0000000000AAA000-memory.dmp

Filesize
1.1MB

Download
memory/2304-1-0x0000000074AD0000-0x00000000751BE000-memory.dmp

Filesize
6.9MB

Download
memory/2304-2-0x0000000000920000-0x0000000000960000-memory.dmp

Filesize
256KB

Download
memory/2304-3-0x0000000000500000-0x0000000000514000-memory.dmp

Filesize
80KB

Download
memory/2304-4-0x0000000074AD0000-0x00000000751BE000-memory.dmp

Filesize
6.9MB

Download
memory/2304-5-0x0000000000920000-0x0000000000960000-memory.dmp

Filesize
256KB

Download