e792148020d2d6e3498bebe16a493ecf01b01723b64c979ba4a811b05f6b7ef6

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 11:23

Target

db8ce55e9c115289f6c159ac36a220aa.exe
Size

185KB
MD5

db8ce55e9c115289f6c159ac36a220aa
SHA1

87f72745efbac39470d3a52f3b6e3ef84f365412
SHA256

e792148020d2d6e3498bebe16a493ecf01b01723b64c979ba4a811b05f6b7ef6
SHA512

3e44dcaba30e1c8e01137bed4164cefb8fef18fb5815e4eeee7d7c4402b07f61e918ff9524ca9871c5573d8dfac7b987bcc400b72d6738e41df7a304fc9cece2
SSDEEP

3072:YUsHrsGfPyJ95sW9Pyky8zOCbDLKyM6wMkit0wua4Do:Y7LvGMky8SCPtMmswEo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2324	2264	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2324	2264	db8ce55e9c115289f6c159ac36a220aa.exe	16
PID 2264 wrote to memory of 2324	2264	db8ce55e9c115289f6c159ac36a220aa.exe	16
PID 2264 wrote to memory of 2324	2264	db8ce55e9c115289f6c159ac36a220aa.exe	16
PID 2264 wrote to memory of 2324	2264	db8ce55e9c115289f6c159ac36a220aa.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 112
1⤵
- Program crash
PID:2324

C:\Users\Admin\AppData\Local\Temp\db8ce55e9c115289f6c159ac36a220aa.exe
"C:\Users\Admin\AppData\Local\Temp\db8ce55e9c115289f6c159ac36a220aa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2264