bc8f26c16a7efde094bafcb914ce6b4a03df39966388fa905958710d729f6ba8

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 20:44

Target

0384fc388b7e9de2146e812523c207bf.exe
Size

160KB
MD5

0384fc388b7e9de2146e812523c207bf
SHA1

b2c83933a6c5e456858bfc19ac21c791578856e2
SHA256

bc8f26c16a7efde094bafcb914ce6b4a03df39966388fa905958710d729f6ba8
SHA512

90cf9419502fac631e2274a7ad3d38fc0cba687957cee3b3acc972095bfde15c5c6454218c699c6a622f60f28185ba4daf31b64eeaee216d62c62a0cb7a8298c
SSDEEP

3072:FTf6++7cd2/1ats1PS+T7eXgrq3KOyMxHOf6rP6a7JHvUaum/faXmnYeV2WDs:9C++7bnSPXH3KTWuf6GaNvTum3MeYeVG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2004	1680	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2004	1680	0384fc388b7e9de2146e812523c207bf.exe	28
PID 1680 wrote to memory of 2004	1680	0384fc388b7e9de2146e812523c207bf.exe	28
PID 1680 wrote to memory of 2004	1680	0384fc388b7e9de2146e812523c207bf.exe	28
PID 1680 wrote to memory of 2004	1680	0384fc388b7e9de2146e812523c207bf.exe	28

C:\Users\Admin\AppData\Local\Temp\0384fc388b7e9de2146e812523c207bf.exe
"C:\Users\Admin\AppData\Local\Temp\0384fc388b7e9de2146e812523c207bf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 36
  2⤵
  - Program crash
  PID:2004

memory/1680-0-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1680-1-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download