b22a3150f150b78caae5673f9e274efc1dc7ec1b3a6ce8b778659d23b77b9213

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:39

Target

1d486893413ec8bc3577c0b69fd496ba.exe
Size

56KB
MD5

1d486893413ec8bc3577c0b69fd496ba
SHA1

c6d91cdfa6268cc8cd4d024b8e22fc81450976eb
SHA256

b22a3150f150b78caae5673f9e274efc1dc7ec1b3a6ce8b778659d23b77b9213
SHA512

2d613cf410b8c170df7e8b57733b8137a2f5fa0b8b12093100bea0435908fb93feb4280fe70d12c66179d34cc7e78015c1f6fe7fcacaa8445e6923287bd627c5
SSDEEP

768:/zpejr2sC32QTA/zB/GoA+U7aJh1SKD8hwHs/1H5WLXdnh:/sP2sU2RBOoA+U+Jh1SKDvucJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1748	2416	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 1748	2416	1d486893413ec8bc3577c0b69fd496ba.exe	28
PID 2416 wrote to memory of 1748	2416	1d486893413ec8bc3577c0b69fd496ba.exe	28
PID 2416 wrote to memory of 1748	2416	1d486893413ec8bc3577c0b69fd496ba.exe	28
PID 2416 wrote to memory of 1748	2416	1d486893413ec8bc3577c0b69fd496ba.exe	28

C:\Users\Admin\AppData\Local\Temp\1d486893413ec8bc3577c0b69fd496ba.exe
"C:\Users\Admin\AppData\Local\Temp\1d486893413ec8bc3577c0b69fd496ba.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 140
  2⤵
  - Program crash
  PID:1748

memory/2416-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2416-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download