74d1b9f987ab230caa57662ed7b3c566e592a4d99b8bc3c65dc87dcff2bb8513

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 21:06

Target

0405f0b1fefb34121b35842e2d681e60.exe
Size

101KB
MD5

0405f0b1fefb34121b35842e2d681e60
SHA1

0b8ea0374f710d4954bfe27e9feb03fd2fc6f1e4
SHA256

74d1b9f987ab230caa57662ed7b3c566e592a4d99b8bc3c65dc87dcff2bb8513
SHA512

c0ad95df2d157d26cba40bf12e2e086bf091b2665ad03da35695932a62e776f57bc9dcb96ad8f2eaa4e73d730ee5f38f37bcd6233fd25d1e4a7af90c4f896599
SSDEEP

1536:v+6I867HUAptrFqpDVoXF0AOYzZIr4nuerbDbQIusErNuYjR4Hlqs:v+6IpDUApGpho1uMZYEuW/83

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1880	1664	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1880	1664	0405f0b1fefb34121b35842e2d681e60.exe	28
PID 1664 wrote to memory of 1880	1664	0405f0b1fefb34121b35842e2d681e60.exe	28
PID 1664 wrote to memory of 1880	1664	0405f0b1fefb34121b35842e2d681e60.exe	28
PID 1664 wrote to memory of 1880	1664	0405f0b1fefb34121b35842e2d681e60.exe	28

C:\Users\Admin\AppData\Local\Temp\0405f0b1fefb34121b35842e2d681e60.exe
"C:\Users\Admin\AppData\Local\Temp\0405f0b1fefb34121b35842e2d681e60.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 140
  2⤵
  - Program crash
  PID:1880

memory/1664-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1664-1-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1664-2-0x00000000001B0000-0x00000000001C6000-memory.dmp

Filesize
88KB

Download