d8ac2789b130251d735b1562eb2da7a56e05dee3741e1357e0522452c3a66c73

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 19:31

Target

01cc961be72ba6ab7d43a57d59b4da00.exe
Size

287KB
MD5

01cc961be72ba6ab7d43a57d59b4da00
SHA1

77a4525d015b0b8079d5cea64bb20e240dc55e5f
SHA256

d8ac2789b130251d735b1562eb2da7a56e05dee3741e1357e0522452c3a66c73
SHA512

906b0db126221f54ba3f9e4650c770009d70aa76a5e2f87ea3651a640b59672ec6c8de9b6090a554553f61199aceabab4609686f44d36ec5d6a7107f631e804c
SSDEEP

6144:n1N65aYY3bAevPcl0OHYXA8Rnm4KQ/45gBcI2Yz6Po9o5QTVm:n1qal3bAevPcyEYQcKQ/LBcI2YzPoST

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2116	1136	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 2116	1136	01cc961be72ba6ab7d43a57d59b4da00.exe	27
PID 1136 wrote to memory of 2116	1136	01cc961be72ba6ab7d43a57d59b4da00.exe	27
PID 1136 wrote to memory of 2116	1136	01cc961be72ba6ab7d43a57d59b4da00.exe	27
PID 1136 wrote to memory of 2116	1136	01cc961be72ba6ab7d43a57d59b4da00.exe	27

C:\Users\Admin\AppData\Local\Temp\01cc961be72ba6ab7d43a57d59b4da00.exe
"C:\Users\Admin\AppData\Local\Temp\01cc961be72ba6ab7d43a57d59b4da00.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 44
  2⤵
  - Program crash
  PID:2116

memory/1136-0-0x0000000000400000-0x0000000000548000-memory.dmp

Filesize
1.3MB

Download
memory/1136-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1136-2-0x0000000000400000-0x0000000000548000-memory.dmp

Filesize
1.3MB

Download
memory/1136-3-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download