deab201d547d05b0f0b6b3a34294fda6f6776c13bda7bd0d61dd39ee040234b7

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:09

Target

014aa0650fd7edb11c6eff17efba4660.exe
Size

102KB
MD5

014aa0650fd7edb11c6eff17efba4660
SHA1

278fede2b8b6b269063b8d4aabbd1576d001a849
SHA256

deab201d547d05b0f0b6b3a34294fda6f6776c13bda7bd0d61dd39ee040234b7
SHA512

6336afc0a1acc43b4ae936790ac7b1a97eaa9e788cf088c083a42760072043f1a1b755d8e4ff4be51b3c1660b279d0ef69ed0f2358612f9d1ba6e397682f4190
SSDEEP

3072:H1UI6nAE9Y38vOUK0nzcqdq/uieLy1VRFLjb9vQg9ynX:H1j6nLazUK0nNoui/51IgWX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2720	2416	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2720	2416	014aa0650fd7edb11c6eff17efba4660.exe	28
PID 2416 wrote to memory of 2720	2416	014aa0650fd7edb11c6eff17efba4660.exe	28
PID 2416 wrote to memory of 2720	2416	014aa0650fd7edb11c6eff17efba4660.exe	28
PID 2416 wrote to memory of 2720	2416	014aa0650fd7edb11c6eff17efba4660.exe	28

C:\Users\Admin\AppData\Local\Temp\014aa0650fd7edb11c6eff17efba4660.exe
"C:\Users\Admin\AppData\Local\Temp\014aa0650fd7edb11c6eff17efba4660.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 36
  2⤵
  - Program crash
  PID:2720

memory/2416-0-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download