37fb162dcdcf38bfbc75c4b07bf247329e1426904c6ef1d1b44e193c4e233bb4

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 23:14

Target

ע/̳.exe
Size

714KB
MD5

e9adf24513acb71e49cc19bb52686259
SHA1

d1b3b784ae3cd7720045820c273ec008bb3807af
SHA256

5f6a01b1354bc8a712f8fa62edfd871102ca75f227430339cb4e46f2e8a590a1
SHA512

31af8fb23555907608d3b22842d7c979ab8e41f4e07c450cc602985b9c0d02c568cda992c4826bd04e565f942ba236dda2f0e100d1af6e1f83edaa8fb7b24d44
SSDEEP

12288:dw9r3scXiNsatCbQWkRTz19ygn5hMa9cvkb010vDaXRefJR7I030Hh6YoQ:dw1ccXiNsiTz19ygrQvkb0uvDa4LnEc8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2960	2312	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2960	2312	̳.exe	14
PID 2312 wrote to memory of 2960	2312	̳.exe	14
PID 2312 wrote to memory of 2960	2312	̳.exe	14
PID 2312 wrote to memory of 2960	2312	̳.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 44
1⤵
- Program crash
PID:2960

C:\Users\Admin\AppData\Local\Temp\ע\̳.exe
"C:\Users\Admin\AppData\Local\Temp\ע\̳.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2312

memory/2312-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2312-0-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2312-2-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2312-4-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download