05ca141cbb8e176391f4594ae4986b19be24841cf8075fd15f2b0ca82660657f

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 20:14

Target

02be5068afc78d1d3d94581c9b32e329.exe
Size

216KB
MD5

02be5068afc78d1d3d94581c9b32e329
SHA1

36103995b09a980ca6a71403f422f3a90cc41d09
SHA256

05ca141cbb8e176391f4594ae4986b19be24841cf8075fd15f2b0ca82660657f
SHA512

b297f56860543178d5c5ab8161ead727c12ee4df7f31a454796370ccab305123dd2c3ddd320b34f3e1081713befaee951681e9ef127a2d508a974d8a64739ff8
SSDEEP

6144:ufNROpBiK0345/KRty3pb+usQ1BjLOJAD5dYl6D7+/RTIg:uF2iL34ERtyZjsQ1BjieYl9/mg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2116	1104	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 2116	1104	02be5068afc78d1d3d94581c9b32e329.exe	20
PID 1104 wrote to memory of 2116	1104	02be5068afc78d1d3d94581c9b32e329.exe	20
PID 1104 wrote to memory of 2116	1104	02be5068afc78d1d3d94581c9b32e329.exe	20
PID 1104 wrote to memory of 2116	1104	02be5068afc78d1d3d94581c9b32e329.exe	20

C:\Users\Admin\AppData\Local\Temp\02be5068afc78d1d3d94581c9b32e329.exe
"C:\Users\Admin\AppData\Local\Temp\02be5068afc78d1d3d94581c9b32e329.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 116
  2⤵
  - Program crash
  PID:2116

memory/1104-0-0x00000000011F0000-0x00000000011FE000-memory.dmp

Filesize
56KB

Download
memory/1104-1-0x00000000011F0000-0x00000000011FE000-memory.dmp

Filesize
56KB

Download