27769698c8e7f2e57e5c952f6dfd6b3c1e9d00b2b23039ce79e7db84cb55d052

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:15

Target

1faafba83319ef185a97824cf113baab.exe
Size

116KB
MD5

1faafba83319ef185a97824cf113baab
SHA1

f5a1bf2f47f51faf8bf666e95a343521558d05f2
SHA256

27769698c8e7f2e57e5c952f6dfd6b3c1e9d00b2b23039ce79e7db84cb55d052
SHA512

93348cfb6ba29a31fd3b9655cc0f34641336cde80ba406a455b5f9133927e8796c274204a8e06ae3accec096663877d0340e76852cb53ef1f8ac329ada3dfce6
SSDEEP

1536:m4OSIJdLb965OxfvbZyuwyFQBtwDQcOe69uGXURDoq4OZZZLlCIibaT:1dyLb9EO5tybyF7DBOSnRD68wb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2504	2560	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2504	2560	1faafba83319ef185a97824cf113baab.exe	28
PID 2560 wrote to memory of 2504	2560	1faafba83319ef185a97824cf113baab.exe	28
PID 2560 wrote to memory of 2504	2560	1faafba83319ef185a97824cf113baab.exe	28
PID 2560 wrote to memory of 2504	2560	1faafba83319ef185a97824cf113baab.exe	28

C:\Users\Admin\AppData\Local\Temp\1faafba83319ef185a97824cf113baab.exe
"C:\Users\Admin\AppData\Local\Temp\1faafba83319ef185a97824cf113baab.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 36
  2⤵
  - Program crash
  PID:2504