0a140386ba63d9bdd1b30b8affd87d14764f7eb61825a81c6124ab0492b6a0f0

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:38

Target

1d3fc9eee86315ea0ab7b556e4e5b29b.exe
Size

179KB
MD5

1d3fc9eee86315ea0ab7b556e4e5b29b
SHA1

0e85126eee5f5fcd82c2f5c430c19ac313d2c3c5
SHA256

0a140386ba63d9bdd1b30b8affd87d14764f7eb61825a81c6124ab0492b6a0f0
SHA512

c6ab8e316068f2c732bd4dd00fb9f6f85d7bcc68dc7a5e7499b65998d115f003cb310b1dd0398857fbe48243a3bfabedc1d0ad2f18563e8403891d677708a483
SSDEEP

3072:ov8Jmb1SOVI9MOQyhlP7oEb+DSp7B5JKB5OxjsYEKmX0b5P6y6Ha92P7XFhj5F:ovUmh59hyht7oeKShKI4YoX0d92Pxh/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2996	2940	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2996	2940	1d3fc9eee86315ea0ab7b556e4e5b29b.exe	14
PID 2940 wrote to memory of 2996	2940	1d3fc9eee86315ea0ab7b556e4e5b29b.exe	14
PID 2940 wrote to memory of 2996	2940	1d3fc9eee86315ea0ab7b556e4e5b29b.exe	14
PID 2940 wrote to memory of 2996	2940	1d3fc9eee86315ea0ab7b556e4e5b29b.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 116
1⤵
- Program crash
PID:2996

C:\Users\Admin\AppData\Local\Temp\1d3fc9eee86315ea0ab7b556e4e5b29b.exe
"C:\Users\Admin\AppData\Local\Temp\1d3fc9eee86315ea0ab7b556e4e5b29b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2940

memory/2940-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2940-0-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2940-2-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2940-3-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download