14bd8fd976bc9685bd87b962ba7d00e4527ae73120318eb2dfb7e516e68111a5

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:54

Target

1db23d8671d074f85e6524c6668cb75a.exe
Size

329KB
MD5

1db23d8671d074f85e6524c6668cb75a
SHA1

fea644013e678781a5eff44440a05a7b9600223b
SHA256

14bd8fd976bc9685bd87b962ba7d00e4527ae73120318eb2dfb7e516e68111a5
SHA512

441cb434b4c533c67f9484147ece0ead1fb80e3beb40316bf78cbf2167410c08fac90d40a74a5e3ed9d24b4d10e08ccf6a8fce4a62c75b9ad02abe6e5295fd85
SSDEEP

6144:9NNN+EUQbxcveBwSjsluIpT+6Y79SCvRFT5lRr6E8RwNmRR5Iey:9/cQymBwSjsjpT+6ESCvRx5Hr6E8RwNd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2128	2320	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2128	2320	1db23d8671d074f85e6524c6668cb75a.exe	20
PID 2320 wrote to memory of 2128	2320	1db23d8671d074f85e6524c6668cb75a.exe	20
PID 2320 wrote to memory of 2128	2320	1db23d8671d074f85e6524c6668cb75a.exe	20
PID 2320 wrote to memory of 2128	2320	1db23d8671d074f85e6524c6668cb75a.exe	20

C:\Users\Admin\AppData\Local\Temp\1db23d8671d074f85e6524c6668cb75a.exe
"C:\Users\Admin\AppData\Local\Temp\1db23d8671d074f85e6524c6668cb75a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 116
  2⤵
  - Program crash
  PID:2128

memory/2320-0-0x0000000000330000-0x0000000000386000-memory.dmp

Filesize
344KB

Download