20bf924bf020204c0c8e8f5ef1b887561a5e14f55e63dbe3de6500613fce76db

Analysis

max time kernel
142s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 00:41

Target

08daabc6bef9965cd29c255e20c13750.exe
Size

84KB
MD5

08daabc6bef9965cd29c255e20c13750
SHA1

595c9e9c84fd00446091156289371b50fb8695ae
SHA256

20bf924bf020204c0c8e8f5ef1b887561a5e14f55e63dbe3de6500613fce76db
SHA512

353a1ffbc31e24c9637a9b23ae965e3bfcfcd72ed2b4dde0649239f3ae81228de31f015f509cc01c98c8b0bbe95dc5a4d43ed72524cda158bda5fb05f42ab3aa
SSDEEP

1536:hoLL8dOf85lHI8tph5LJUPDzHOzrM/QVAwP3ygkpXj7rb:hoLL8dOfeHINXu/AwPCgkpXjT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2184	1360	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 2184	1360	08daabc6bef9965cd29c255e20c13750.exe	24
PID 1360 wrote to memory of 2184	1360	08daabc6bef9965cd29c255e20c13750.exe	24
PID 1360 wrote to memory of 2184	1360	08daabc6bef9965cd29c255e20c13750.exe	24
PID 1360 wrote to memory of 2184	1360	08daabc6bef9965cd29c255e20c13750.exe	24

C:\Users\Admin\AppData\Local\Temp\08daabc6bef9965cd29c255e20c13750.exe
"C:\Users\Admin\AppData\Local\Temp\08daabc6bef9965cd29c255e20c13750.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 148
  2⤵
  - Program crash
  PID:2184

memory/1360-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download