8d382d97cf81d1e1418080a25c47b169eb3dba60d782aae9b1f7087994f05d51

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:42

Target

1ec9cea930eb417afddf0cd040ab9e35.exe
Size

55KB
MD5

1ec9cea930eb417afddf0cd040ab9e35
SHA1

bc418505d23731396ff600d36f3aff891a082268
SHA256

8d382d97cf81d1e1418080a25c47b169eb3dba60d782aae9b1f7087994f05d51
SHA512

bd6e27fff51720755417c8f5c6e701c221469877c656ec39d9ecc994acdbb76119f62a2122e6cd7b7c1565593c30eb4d8defdca54a0e88a6943028a69d93844a
SSDEEP

768:0V+dkH5/qrCnHFJ/r4aYEQdrXApHbaayLqzLXWhszNuzTc8/1H5xnFXdnhg:fdW5/oCnHrkaod8LKq/XWisU+P

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2664	2908	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2664	2908	1ec9cea930eb417afddf0cd040ab9e35.exe	28
PID 2908 wrote to memory of 2664	2908	1ec9cea930eb417afddf0cd040ab9e35.exe	28
PID 2908 wrote to memory of 2664	2908	1ec9cea930eb417afddf0cd040ab9e35.exe	28
PID 2908 wrote to memory of 2664	2908	1ec9cea930eb417afddf0cd040ab9e35.exe	28

C:\Users\Admin\AppData\Local\Temp\1ec9cea930eb417afddf0cd040ab9e35.exe
"C:\Users\Admin\AppData\Local\Temp\1ec9cea930eb417afddf0cd040ab9e35.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 140
  2⤵
  - Program crash
  PID:2664

memory/2908-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2908-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download