f77c001dbff70c0fe72ae9521cba5edee46eb68d67a441536d8acec0803ed2f6

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 22:35

Target

05c47cb229b642b377f328eef5d30517.exe
Size

368KB
MD5

05c47cb229b642b377f328eef5d30517
SHA1

ffd858a453dec3328cabdc7164129a48f09ffd41
SHA256

f77c001dbff70c0fe72ae9521cba5edee46eb68d67a441536d8acec0803ed2f6
SHA512

9168ffe8e4d5aa4b58b0e7280af2d856d38bfc38be2415328feb0db83b7345d26ac47738b081a9a0d00680841d163ac5113521c42bd5800bafc1bd81eb62c5a7
SSDEEP

6144:RTAp4naqm5GR/0N4Ftn6vicI8qtQQenKDFujBeqSDgzB8jk3ES:R041m5Q/0N4L9xYus1NSD2Cg3N

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2932	1436	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 2932	1436	05c47cb229b642b377f328eef5d30517.exe	28
PID 1436 wrote to memory of 2932	1436	05c47cb229b642b377f328eef5d30517.exe	28
PID 1436 wrote to memory of 2932	1436	05c47cb229b642b377f328eef5d30517.exe	28
PID 1436 wrote to memory of 2932	1436	05c47cb229b642b377f328eef5d30517.exe	28

C:\Users\Admin\AppData\Local\Temp\05c47cb229b642b377f328eef5d30517.exe
"C:\Users\Admin\AppData\Local\Temp\05c47cb229b642b377f328eef5d30517.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 116
  2⤵
  - Program crash
  PID:2932

memory/1436-0-0x0000000001290000-0x00000000012F0000-memory.dmp

Filesize
384KB

Download