6ea9f53ff27bf2cf3ea2fe254bf3ea205d2f6a34f99e3dd070a4fde9a9a878a1

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:27

Target

1cfdd1c3719fa89255fd65b8294c2bf1.exe
Size

85KB
MD5

1cfdd1c3719fa89255fd65b8294c2bf1
SHA1

aa472196a1a88243e68f0fe190ff623ccb73858c
SHA256

6ea9f53ff27bf2cf3ea2fe254bf3ea205d2f6a34f99e3dd070a4fde9a9a878a1
SHA512

312ad2f01e926c94b3e37922aaa23d993c397cf917e9a093cd83f8ef2d70d428eb7766a52cfa545d456e14da69d6e8eaac3ad1e90e5fd031623fe9ca540c390d
SSDEEP

768:Xa5oBX9PEDgCncnD8E853R+zrR5hPH41onAxKjjOe/6mwN0PuvqfQRhPQqvwK335:XuOkcnDH8qZevFvqfQvvR8T0f99Sy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2372	1820	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2372	1820	1cfdd1c3719fa89255fd65b8294c2bf1.exe	28
PID 1820 wrote to memory of 2372	1820	1cfdd1c3719fa89255fd65b8294c2bf1.exe	28
PID 1820 wrote to memory of 2372	1820	1cfdd1c3719fa89255fd65b8294c2bf1.exe	28
PID 1820 wrote to memory of 2372	1820	1cfdd1c3719fa89255fd65b8294c2bf1.exe	28

C:\Users\Admin\AppData\Local\Temp\1cfdd1c3719fa89255fd65b8294c2bf1.exe
"C:\Users\Admin\AppData\Local\Temp\1cfdd1c3719fa89255fd65b8294c2bf1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 56
  2⤵
  - Program crash
  PID:2372

memory/1820-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download