9e1d0d04adce4944f4f1bc9bc94c0d22ebfa8346a2ab56ef22dba0fe11c69f41

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:54

Target

1f195737e64d0fb15d4fe2451de5ec46.exe
Size

80KB
MD5

1f195737e64d0fb15d4fe2451de5ec46
SHA1

f2db3ef5a90ebdc1a001c1b0b7d53521e3f7964f
SHA256

9e1d0d04adce4944f4f1bc9bc94c0d22ebfa8346a2ab56ef22dba0fe11c69f41
SHA512

3e708beaca1afddcdd37595018b6bd28a1cf8efe712060f01f47ccfe03d119ce241eaff7c0ad2f76e90dc8b188fdf93e62d277634dbc2a4278549ce7e456d76f
SSDEEP

1536:VuS4I+JmHrhyCjqA+QjagSKulfgj8/YvegJXd7+YF8BOv:ZN+QrPjGQsc8K3JX9+YFv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1740	660	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 1740	660	1f195737e64d0fb15d4fe2451de5ec46.exe	28
PID 660 wrote to memory of 1740	660	1f195737e64d0fb15d4fe2451de5ec46.exe	28
PID 660 wrote to memory of 1740	660	1f195737e64d0fb15d4fe2451de5ec46.exe	28
PID 660 wrote to memory of 1740	660	1f195737e64d0fb15d4fe2451de5ec46.exe	28

C:\Users\Admin\AppData\Local\Temp\1f195737e64d0fb15d4fe2451de5ec46.exe
"C:\Users\Admin\AppData\Local\Temp\1f195737e64d0fb15d4fe2451de5ec46.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 660 -s 104
  2⤵
  - Program crash
  PID:1740

memory/660-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/660-1-0x0000000001000000-0x00000000010A5000-memory.dmp

Filesize
660KB

Download
memory/660-0-0x0000000001000000-0x00000000010A5000-memory.dmp

Filesize
660KB

Download
memory/660-3-0x0000000001000000-0x00000000010A5000-memory.dmp

Filesize
660KB

Download