0544726e48bd25ce9d4e077ee6395dda74e8fbcb65106c26db3db21b74d26a45

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 20:21

Target

02ee01c65b1bd481aba84ddd5889730f.exe
Size

76KB
MD5

02ee01c65b1bd481aba84ddd5889730f
SHA1

46584954855a943696b17a64b7542f3818d23c3f
SHA256

0544726e48bd25ce9d4e077ee6395dda74e8fbcb65106c26db3db21b74d26a45
SHA512

cebcaa1ac4ba3bfb14ffdc7037482b8e30b40a3cb26165d782fe155b2126adac9390d8242090a1e11eca05ec0b5795f0a553a5032dbe5c3c5158ceb7f5a4dcb2
SSDEEP

1536:XpI7m+17tO9hNS6ldrVDyGaQlDnOXWWJhKs5nNs7apjVrs2ryrd1vUQuq6:XpzmYhN/pVDXvhnO/hP3Hs2qo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1720	1732	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1720	1732	02ee01c65b1bd481aba84ddd5889730f.exe	28
PID 1732 wrote to memory of 1720	1732	02ee01c65b1bd481aba84ddd5889730f.exe	28
PID 1732 wrote to memory of 1720	1732	02ee01c65b1bd481aba84ddd5889730f.exe	28
PID 1732 wrote to memory of 1720	1732	02ee01c65b1bd481aba84ddd5889730f.exe	28

C:\Users\Admin\AppData\Local\Temp\02ee01c65b1bd481aba84ddd5889730f.exe
"C:\Users\Admin\AppData\Local\Temp\02ee01c65b1bd481aba84ddd5889730f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 36
  2⤵
  - Program crash
  PID:1720

memory/1732-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download