01a55be3508dc7306dd007564ea593e27f58f773e375676686cd8d79bb4e001d

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 22:57

Target

064a7cbadbb333154220db3c193892c5.exe
Size

262KB
MD5

064a7cbadbb333154220db3c193892c5
SHA1

1f1af9226134e11f6544c3d7366a905898aaac78
SHA256

01a55be3508dc7306dd007564ea593e27f58f773e375676686cd8d79bb4e001d
SHA512

9db904fa5f04d2394cfb6c67eb2121e6d303a88c79737fc58839618781fa5cbcb9863321d3fbfffa30737157de4935816dd8a84b577fca90d743153246ec60a7
SSDEEP

3072:rZCoPj5CLQSKasAU3qKxWjpFspG8m2V+ZVZvoSsCsjLUbEYukln:VCoPj5C1nslXWG/CssXucn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2196	1276	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 2196	1276	064a7cbadbb333154220db3c193892c5.exe	16
PID 1276 wrote to memory of 2196	1276	064a7cbadbb333154220db3c193892c5.exe	16
PID 1276 wrote to memory of 2196	1276	064a7cbadbb333154220db3c193892c5.exe	16
PID 1276 wrote to memory of 2196	1276	064a7cbadbb333154220db3c193892c5.exe	16

C:\Users\Admin\AppData\Local\Temp\064a7cbadbb333154220db3c193892c5.exe
"C:\Users\Admin\AppData\Local\Temp\064a7cbadbb333154220db3c193892c5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 196
  2⤵
  - Program crash
  PID:2196

memory/1276-0-0x0000000000010000-0x0000000000056000-memory.dmp

Filesize
280KB

Download