e4c0e3b3a4e271cc97d9f317c6adc5f672dcdd78d6a820de454f6adc951d7265

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:40

Target

0208ad8042196c06981a4d20b29fd858.exe
Size

16KB
MD5

0208ad8042196c06981a4d20b29fd858
SHA1

9c643877e964ce763b1e33d641cc32db4407c711
SHA256

e4c0e3b3a4e271cc97d9f317c6adc5f672dcdd78d6a820de454f6adc951d7265
SHA512

757d50a8a6d22eea87a0bbfbdcbb74c4d85ee52b81797b7a3ea4822b08e5d8d94817f828a1e0c5c70de5f11390fa592de44905306ad808c52603db3d4f49ed8b
SSDEEP

192:nDsMgDpQ+M/Yrn9fGZt381r96hXUVns2TcLADrY6cQKmDyeCd9ckz:DsZDpQj/Yrn9fGZGB9bVnhc8rwYMh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1940	2104	WerFault.exe	9

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 1940	2104	0208ad8042196c06981a4d20b29fd858.exe	16
PID 2104 wrote to memory of 1940	2104	0208ad8042196c06981a4d20b29fd858.exe	16
PID 2104 wrote to memory of 1940	2104	0208ad8042196c06981a4d20b29fd858.exe	16
PID 2104 wrote to memory of 1940	2104	0208ad8042196c06981a4d20b29fd858.exe	16

C:\Users\Admin\AppData\Local\Temp\0208ad8042196c06981a4d20b29fd858.exe
"C:\Users\Admin\AppData\Local\Temp\0208ad8042196c06981a4d20b29fd858.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 36
  2⤵
  - Program crash
  PID:1940

memory/2104-0-0x0000000013140000-0x0000000013150000-memory.dmp

Filesize
64KB

Download