cabcd75d83e09ecca4d9ea56f5e6abe12842803bdb5eda2922ed093802a5d2ed

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 20:55

Target

03c2b414498d24a62173075df8a27ed5.exe
Size

119KB
MD5

03c2b414498d24a62173075df8a27ed5
SHA1

f55db326c68af905993550ca9bca616a516eb32d
SHA256

cabcd75d83e09ecca4d9ea56f5e6abe12842803bdb5eda2922ed093802a5d2ed
SHA512

9813050d7675f8b502f3d631275c38ab6cea25384c1b475b3260a24ea98f822c065ffcd59cda44a3367aa6446386b6d35cb26a530ac14f80bb1ac2e480407eb6
SSDEEP

3072:UDVzRtUDltTdiUQrUIILlIfcsepuQ/BgwnXNS2W:kN25Tihr2M/KuDiS2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2300	1308	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2300	1308	03c2b414498d24a62173075df8a27ed5.exe	28
PID 1308 wrote to memory of 2300	1308	03c2b414498d24a62173075df8a27ed5.exe	28
PID 1308 wrote to memory of 2300	1308	03c2b414498d24a62173075df8a27ed5.exe	28
PID 1308 wrote to memory of 2300	1308	03c2b414498d24a62173075df8a27ed5.exe	28

C:\Users\Admin\AppData\Local\Temp\03c2b414498d24a62173075df8a27ed5.exe
"C:\Users\Admin\AppData\Local\Temp\03c2b414498d24a62173075df8a27ed5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 308
  2⤵
  - Program crash
  PID:2300

memory/1308-0-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1308-3-0x0000000000320000-0x0000000000367000-memory.dmp

Filesize
284KB

Download
memory/1308-2-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1308-4-0x00000000002D0000-0x00000000002E5000-memory.dmp

Filesize
84KB

Download
memory/1308-5-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/1308-6-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1308-7-0x0000000000320000-0x0000000000367000-memory.dmp

Filesize
284KB

Download