1d19dbc43197a1ec97a4d765821a6a29aec83bf793cd79e6b248cc3512ec1744

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 20:49

Target

f730bb0317227aa839b6789defdd522f.exe
Size

420KB
MD5

f730bb0317227aa839b6789defdd522f
SHA1

ba951f5df829f17f156b70962b6eb700d773d47c
SHA256

1d19dbc43197a1ec97a4d765821a6a29aec83bf793cd79e6b248cc3512ec1744
SHA512

6fd97b44a15f120011af6f682c74fe653a74f4d8bf40c673de33466e79dd8e29bab8fd2f471cde82dbd64610776ef40e2a26f83313756f35b0f9e2262b940579
SSDEEP

6144:ykB1INZdWaFzaE7mDGg7Y4+MFyBPys80G5sEOi9Ri9na5UVx3Q:ykBgdW/E7mDGg8xMkBp80GiZa5UVhQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2176	1956	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2176	1956	f730bb0317227aa839b6789defdd522f.exe	28
PID 1956 wrote to memory of 2176	1956	f730bb0317227aa839b6789defdd522f.exe	28
PID 1956 wrote to memory of 2176	1956	f730bb0317227aa839b6789defdd522f.exe	28
PID 1956 wrote to memory of 2176	1956	f730bb0317227aa839b6789defdd522f.exe	28

C:\Users\Admin\AppData\Local\Temp\f730bb0317227aa839b6789defdd522f.exe
"C:\Users\Admin\AppData\Local\Temp\f730bb0317227aa839b6789defdd522f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 116
  2⤵
  - Program crash
  PID:2176

memory/1956-0-0x0000000000250000-0x00000000002BE000-memory.dmp

Filesize
440KB

Download