3880fbb8baa98dacd5e0b62eddde70e4db35b82642a897d08d3f0c5b9c766b8e

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 21:06

Target

f82cd786d3442caf7a32d85e8e475d5a.exe
Size

422KB
MD5

f82cd786d3442caf7a32d85e8e475d5a
SHA1

e6b1b07b478f4c210839f4169f83ad7b9b45c97a
SHA256

3880fbb8baa98dacd5e0b62eddde70e4db35b82642a897d08d3f0c5b9c766b8e
SHA512

345a14f504129a091fa390f0dafffa25152f512bf46d4279395807a4f63ffa85641a5a98feacd80099cff3f8868ffa71a762c651cac5c49d6734e5c230ffcfe1
SSDEEP

6144:ykB1INZdWaFzaE7mDGg7Y4+MFyBPys80G5sEOi9Ri9na5UVx3:ykBgdW/E7mDGg8xMkBp80GiZa5UVh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2512	2224	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2512	2224	f82cd786d3442caf7a32d85e8e475d5a.exe	28
PID 2224 wrote to memory of 2512	2224	f82cd786d3442caf7a32d85e8e475d5a.exe	28
PID 2224 wrote to memory of 2512	2224	f82cd786d3442caf7a32d85e8e475d5a.exe	28
PID 2224 wrote to memory of 2512	2224	f82cd786d3442caf7a32d85e8e475d5a.exe	28

C:\Users\Admin\AppData\Local\Temp\f82cd786d3442caf7a32d85e8e475d5a.exe
"C:\Users\Admin\AppData\Local\Temp\f82cd786d3442caf7a32d85e8e475d5a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 116
  2⤵
  - Program crash
  PID:2512

memory/2224-0-0x0000000000A20000-0x0000000000A8E000-memory.dmp

Filesize
440KB

Download