30139e5e4d9250dffa374c7b073bbab29c968def6af9b81f6902f595b100fc00

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:36

Target

1ea406f65ff2c8079ea3a486a00f566b.exe
Size

214KB
MD5

1ea406f65ff2c8079ea3a486a00f566b
SHA1

dca795a4f39bc4fee9d56d05613e83997c1c0f9f
SHA256

30139e5e4d9250dffa374c7b073bbab29c968def6af9b81f6902f595b100fc00
SHA512

629c90ab7f45edfd74311a7c053c8df311a2685130ee457b8af7377a976c7510e1f664a4ed44db779e999f07e2fef7f400b102a6934214dc8df340e561896941
SSDEEP

3072:AwwUbERIK5g/BTrlUPT7OFL6Y5UwRHuGdJwTvLHRyGzIr8yoWjYW:Axb4VKvOd6YBugGzI4yoWjY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3028	2940	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 3028	2940	1ea406f65ff2c8079ea3a486a00f566b.exe	17
PID 2940 wrote to memory of 3028	2940	1ea406f65ff2c8079ea3a486a00f566b.exe	17
PID 2940 wrote to memory of 3028	2940	1ea406f65ff2c8079ea3a486a00f566b.exe	17
PID 2940 wrote to memory of 3028	2940	1ea406f65ff2c8079ea3a486a00f566b.exe	17

C:\Users\Admin\AppData\Local\Temp\1ea406f65ff2c8079ea3a486a00f566b.exe
"C:\Users\Admin\AppData\Local\Temp\1ea406f65ff2c8079ea3a486a00f566b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 36
  2⤵
  - Program crash
  PID:3028

memory/2940-0-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download