28be765816314cb864f05cc7da60571af908811cbb63e7dc24bf1c553cfffcc8

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:00

Target

0657c611bd7f1ea9d1047d1761bb0228.exe
Size

422KB
MD5

0657c611bd7f1ea9d1047d1761bb0228
SHA1

f7c74b184f354d9d8788030abc985c5a1a931f97
SHA256

28be765816314cb864f05cc7da60571af908811cbb63e7dc24bf1c553cfffcc8
SHA512

13eb7c68f227e370412c666340274876eb03fd6f02b3d2de2935a8fd0ca2fd0e41a387c966e927db4dc56c5c57e41ef12e30b61e8bb53114ffc862a640d17fe2
SSDEEP

6144:ykB1INZdWaFzaE7mDGg7Y4+MFyBPys80G5sEOi9Ri9na5UVx3:ykBgdW/E7mDGg8xMkBp80GiZa5UVh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2076	2868	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2076	2868	0657c611bd7f1ea9d1047d1761bb0228.exe	14
PID 2868 wrote to memory of 2076	2868	0657c611bd7f1ea9d1047d1761bb0228.exe	14
PID 2868 wrote to memory of 2076	2868	0657c611bd7f1ea9d1047d1761bb0228.exe	14
PID 2868 wrote to memory of 2076	2868	0657c611bd7f1ea9d1047d1761bb0228.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 116
1⤵
- Program crash
PID:2076

C:\Users\Admin\AppData\Local\Temp\0657c611bd7f1ea9d1047d1761bb0228.exe
"C:\Users\Admin\AppData\Local\Temp\0657c611bd7f1ea9d1047d1761bb0228.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868

memory/2868-0-0x0000000001320000-0x000000000138E000-memory.dmp

Filesize
440KB

Download