1bef1ecfe82b758b015202417621b757fe1b7c2d04b68aeb3ddfdb1ed3f2a269

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 00:22

Target

08678a85fb4a88aebe8740b048dab4ed.exe
Size

367KB
MD5

08678a85fb4a88aebe8740b048dab4ed
SHA1

4dff9af4ae6f42d0770ca762ca75dc4e7d16e836
SHA256

1bef1ecfe82b758b015202417621b757fe1b7c2d04b68aeb3ddfdb1ed3f2a269
SHA512

08c0b33b13099d985b894f75cf15fead8fa11074257410a115af96b8b0bb87037ba6bebe5ce9ddd655d83aadd8a6fa9a723c4caace1a1ac22e058ec0766ed63d
SSDEEP

6144:rpEcAd/Mm5ZkyUneRTnJOmQ4W4/6zA5K0TzJRCp4xRvKUllD/W13+P:rTAOm5eyUnJmCzAXTzJR3RvK6lCwP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1104	2644	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 1104	2644	08678a85fb4a88aebe8740b048dab4ed.exe	28
PID 2644 wrote to memory of 1104	2644	08678a85fb4a88aebe8740b048dab4ed.exe	28
PID 2644 wrote to memory of 1104	2644	08678a85fb4a88aebe8740b048dab4ed.exe	28
PID 2644 wrote to memory of 1104	2644	08678a85fb4a88aebe8740b048dab4ed.exe	28

C:\Users\Admin\AppData\Local\Temp\08678a85fb4a88aebe8740b048dab4ed.exe
"C:\Users\Admin\AppData\Local\Temp\08678a85fb4a88aebe8740b048dab4ed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 116
  2⤵
  - Program crash
  PID:1104

memory/2644-0-0x0000000001040000-0x00000000010A0000-memory.dmp

Filesize
384KB

Download