54bba604ff7ad3f5230813809a6df5269cd7efaa9ffc326f5a2a60b1a2c31454

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 20:29

Target

f601b7287d2e733f11ddd0f725ea321e.exe
Size

106KB
MD5

f601b7287d2e733f11ddd0f725ea321e
SHA1

5910b4b2b7dc8b9a4b1057bb592a51ae34c2447a
SHA256

54bba604ff7ad3f5230813809a6df5269cd7efaa9ffc326f5a2a60b1a2c31454
SHA512

26ad062ee55455e2847955a8bdf8c7386a3a787ec9c1994069645ecad6c8cc3a0df45a1a71cbd297da85e9e8c5369a5a2497eaee7d48e8e2db94669cb6cdac20
SSDEEP

1536:v+FDoKtniY1u7Nn2JFkC2styJjCKICFjC7EWisS+5mlatSfkZ:v+FDzK71QkbstyJjCKICpC72s/mlaX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
848	2356	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 848	2356	f601b7287d2e733f11ddd0f725ea321e.exe	28
PID 2356 wrote to memory of 848	2356	f601b7287d2e733f11ddd0f725ea321e.exe	28
PID 2356 wrote to memory of 848	2356	f601b7287d2e733f11ddd0f725ea321e.exe	28
PID 2356 wrote to memory of 848	2356	f601b7287d2e733f11ddd0f725ea321e.exe	28

C:\Users\Admin\AppData\Local\Temp\f601b7287d2e733f11ddd0f725ea321e.exe
"C:\Users\Admin\AppData\Local\Temp\f601b7287d2e733f11ddd0f725ea321e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 128
  2⤵
  - Program crash
  PID:848

memory/2356-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download