3c59fa4afbf8a1ab1e35f42abca166fce5c3cc181339e0fb75020e0d764bb976

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 23:05

Target

febbe7d9b7e8848d7eac75ccca7cc929.exe
Size

180KB
MD5

febbe7d9b7e8848d7eac75ccca7cc929
SHA1

01d8926901fe86eeee1bf4fb48066a0e6322428e
SHA256

3c59fa4afbf8a1ab1e35f42abca166fce5c3cc181339e0fb75020e0d764bb976
SHA512

536fec6453a8b0399954a36b6025bd1ac2672578f0c2ed7ec271a55982f058f90b9e825c31aa6ee40940cf5c60d0792c048ee465bea42c29c42f62381bc5bcce
SSDEEP

3072:CnPx8qNN8WuocfPlIUg53ryoIy73Yjua/mJWKquNUsV8G4eX1qmR8aFisU9:CV/8lVpIOol7e/xKquNXV87IvvFy9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1148	3012	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 1148	3012	febbe7d9b7e8848d7eac75ccca7cc929.exe	18
PID 3012 wrote to memory of 1148	3012	febbe7d9b7e8848d7eac75ccca7cc929.exe	18
PID 3012 wrote to memory of 1148	3012	febbe7d9b7e8848d7eac75ccca7cc929.exe	18
PID 3012 wrote to memory of 1148	3012	febbe7d9b7e8848d7eac75ccca7cc929.exe	18

C:\Users\Admin\AppData\Local\Temp\febbe7d9b7e8848d7eac75ccca7cc929.exe
"C:\Users\Admin\AppData\Local\Temp\febbe7d9b7e8848d7eac75ccca7cc929.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 44
  2⤵
  - Program crash
  PID:1148

memory/3012-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3012-1-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download