fd35d4f233883ebf8f01f3dee06a887cb04e8691c2cf540240efca74470243fe

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 00:42

Target

08dfd7765a31859cfa1c07b2fbad487b.exe
Size

537KB
MD5

08dfd7765a31859cfa1c07b2fbad487b
SHA1

d5e6bc2e7bd7c8b0f5fcfe1b18e643276ebf5093
SHA256

fd35d4f233883ebf8f01f3dee06a887cb04e8691c2cf540240efca74470243fe
SHA512

89f97c9c869a17d8bc058740c9648948cbad691561aaec561c4cd4d0ee781448b6dee7178abd34bdfb131e33853bf2f403fee5bbcc4cdff2a36ddef825b05fde
SSDEEP

12288:p695dEMH/UxCmxbw1C2CMVJs9FCvHQo30veSBiQPp4kv8jZ:k9sx3w1pVJCFzRGELPpFUF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2516	1212	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 2516	1212	08dfd7765a31859cfa1c07b2fbad487b.exe	16
PID 1212 wrote to memory of 2516	1212	08dfd7765a31859cfa1c07b2fbad487b.exe	16
PID 1212 wrote to memory of 2516	1212	08dfd7765a31859cfa1c07b2fbad487b.exe	16
PID 1212 wrote to memory of 2516	1212	08dfd7765a31859cfa1c07b2fbad487b.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 120
1⤵
- Program crash
PID:2516

C:\Users\Admin\AppData\Local\Temp\08dfd7765a31859cfa1c07b2fbad487b.exe
"C:\Users\Admin\AppData\Local\Temp\08dfd7765a31859cfa1c07b2fbad487b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1212

memory/1212-0-0x0000000000400000-0x0000000000506096-memory.dmp

Filesize
1.0MB

Download
memory/1212-1-0x0000000000400000-0x0000000000506096-memory.dmp

Filesize
1.0MB

Download