9d407d5c70f13e99ef8e5bcd05a116a3fcf86a10cacb958637b44ae48e9d84d6

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 20:17

Target

02d19b2600efd42887309c58ca717c74.exe
Size

126KB
MD5

02d19b2600efd42887309c58ca717c74
SHA1

37d6c1ab8073f3eb5564e2bc273523ec5f39904b
SHA256

9d407d5c70f13e99ef8e5bcd05a116a3fcf86a10cacb958637b44ae48e9d84d6
SHA512

a66721aa034803ce8041c629096b824b40f726bbc03c78a788d38548b0c68ded386e2f3352565c2b642ae0a9323dbae16e85b69b06abdc985eb91c074a03e315
SSDEEP

3072:Obrl1o8gIClYOMfTgweH0Y+xurOQ3eenxnTsJ+KaMCzOcnd3u:OF1PgISYOMZYuurOQ37xQJ+KazCcU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2088	1728	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2088	1728	02d19b2600efd42887309c58ca717c74.exe	28
PID 1728 wrote to memory of 2088	1728	02d19b2600efd42887309c58ca717c74.exe	28
PID 1728 wrote to memory of 2088	1728	02d19b2600efd42887309c58ca717c74.exe	28
PID 1728 wrote to memory of 2088	1728	02d19b2600efd42887309c58ca717c74.exe	28

C:\Users\Admin\AppData\Local\Temp\02d19b2600efd42887309c58ca717c74.exe
"C:\Users\Admin\AppData\Local\Temp\02d19b2600efd42887309c58ca717c74.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 36
  2⤵
  - Program crash
  PID:2088

memory/1728-0-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1728-1-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download