e2e121bab9653c239158b27e4adde84f7d593ee0095f2bcda82a6e06cc124c62

Analysis

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:07

Target

000d22e44e51082907df1537221c08a8.exe
Size

120KB
MD5

000d22e44e51082907df1537221c08a8
SHA1

2a426a60598d7e70d816185fd2e8b070f75562ed
SHA256

e2e121bab9653c239158b27e4adde84f7d593ee0095f2bcda82a6e06cc124c62
SHA512

9f8d8dee37af804100c91dc220ea7b940599e9ae81093fa02ac6d6616165506e711f34a496de84727add5e73945087ebd40226f3761288ef37f36315ab6dbe42
SSDEEP

1536:VStuF+JTaOPTXqE4MO6wG/CCaZWwvQOpwnH6behBhVTX3q7VoagH2:VXeVPT6oOV1WoDwaiLza7Voa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2300	2656	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2300	2656	000d22e44e51082907df1537221c08a8.exe	1
PID 2656 wrote to memory of 2300	2656	000d22e44e51082907df1537221c08a8.exe	1
PID 2656 wrote to memory of 2300	2656	000d22e44e51082907df1537221c08a8.exe	1
PID 2656 wrote to memory of 2300	2656	000d22e44e51082907df1537221c08a8.exe	1

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 108
1⤵
- Program crash
PID:2300

C:\Users\Admin\AppData\Local\Temp\000d22e44e51082907df1537221c08a8.exe
"C:\Users\Admin\AppData\Local\Temp\000d22e44e51082907df1537221c08a8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2656

memory/2656-0-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download