0ef1eea6d342c07c97238eed4961a654feee394c48d4a3f3f77d2f73d7a39694

Analysis

max time kernel
142s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 19:45

Target

022950ec5e3c34ea55218eaafe606171.exe
Size

350KB
MD5

022950ec5e3c34ea55218eaafe606171
SHA1

fc1689b23f4d1fa049546066aeb2ede3e4ef9da8
SHA256

0ef1eea6d342c07c97238eed4961a654feee394c48d4a3f3f77d2f73d7a39694
SHA512

1e87ef76c86558bb74cdfe9078a7360334a9bc30f30f13590bab460fc787d16d119851e5a2814827214c108531035020f6e0a756ce47f6d6dd1d0ba4f06531d1
SSDEEP

6144:FqJbtehK2mxNu95+3KAI9XMoCqr8DqXYrIqKcT4/B6wv6s52tfsXfDOaJsZ6qyDz:kt/Ju9lAIm8ucYrGgyB6+4fsXfjhz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2760	2600	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2760	2600	022950ec5e3c34ea55218eaafe606171.exe	28
PID 2600 wrote to memory of 2760	2600	022950ec5e3c34ea55218eaafe606171.exe	28
PID 2600 wrote to memory of 2760	2600	022950ec5e3c34ea55218eaafe606171.exe	28
PID 2600 wrote to memory of 2760	2600	022950ec5e3c34ea55218eaafe606171.exe	28

C:\Users\Admin\AppData\Local\Temp\022950ec5e3c34ea55218eaafe606171.exe
"C:\Users\Admin\AppData\Local\Temp\022950ec5e3c34ea55218eaafe606171.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 88
  2⤵
  - Program crash
  PID:2760

memory/2600-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download