1f6e9fdbac41b32be010c9c2e3b753e1ab85e238a5608727cca51ba8b236e9fc

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 19:58

Target

027238fffe8864da0cec728a684b1cb1.exe
Size

1.5MB
MD5

027238fffe8864da0cec728a684b1cb1
SHA1

f966a14a7f10c558ef4d62189dfa8e1cefb5264d
SHA256

1f6e9fdbac41b32be010c9c2e3b753e1ab85e238a5608727cca51ba8b236e9fc
SHA512

7b29883da44f7e3a2d3cc3e447cb020dfaadb77525fb6e9f82e86c4527c6cf626fd1ee28c3fc00a97dd1dd26fa4603575b2ec899925e3b6be580d1a36671e589
SSDEEP

24576:jN3D50qc9ryjJWkFz0XpxQ3LAOUjENGlkt4wjQ73zbgZdSqeDtD9mF8WWL7:150WjlFmpy3LAPIDvQ3zadbeOi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1304	2040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1304	2040	027238fffe8864da0cec728a684b1cb1.exe	28
PID 2040 wrote to memory of 1304	2040	027238fffe8864da0cec728a684b1cb1.exe	28
PID 2040 wrote to memory of 1304	2040	027238fffe8864da0cec728a684b1cb1.exe	28
PID 2040 wrote to memory of 1304	2040	027238fffe8864da0cec728a684b1cb1.exe	28

C:\Users\Admin\AppData\Local\Temp\027238fffe8864da0cec728a684b1cb1.exe
"C:\Users\Admin\AppData\Local\Temp\027238fffe8864da0cec728a684b1cb1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 88
  2⤵
  - Program crash
  PID:1304

memory/2040-0-0x0000000000200000-0x0000000000384000-memory.dmp

Filesize
1.5MB

Download