cb1891b934a1c6a447b0af2a1f922b3a13eafb9173bfea839fd536f1a5eb973d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:42

Target

0a73a1b26c19c8dcb5141264d857ffa4.exe
Size

70KB
MD5

0a73a1b26c19c8dcb5141264d857ffa4
SHA1

1a536746425ec6f54cad5258ce4a0b35d95e4a71
SHA256

cb1891b934a1c6a447b0af2a1f922b3a13eafb9173bfea839fd536f1a5eb973d
SHA512

2c70261baa8586d8dc61e375d8765740d52e69f7870ee7ef9041ea4be7de91691874c89309e77e9b30011f06403c44b1d40aab5f34a1a876dd2d52bd40fadcce
SSDEEP

768:ygQ25vJo/rEzOGLyFGEgbJqAIlmjsSF7ZnD5iuK1GsDV6:ygQ2zo/r9BEE9AIlerzD5k1W

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	1960	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2224	1960	0a73a1b26c19c8dcb5141264d857ffa4.exe	28
PID 1960 wrote to memory of 2224	1960	0a73a1b26c19c8dcb5141264d857ffa4.exe	28
PID 1960 wrote to memory of 2224	1960	0a73a1b26c19c8dcb5141264d857ffa4.exe	28
PID 1960 wrote to memory of 2224	1960	0a73a1b26c19c8dcb5141264d857ffa4.exe	28

C:\Users\Admin\AppData\Local\Temp\0a73a1b26c19c8dcb5141264d857ffa4.exe
"C:\Users\Admin\AppData\Local\Temp\0a73a1b26c19c8dcb5141264d857ffa4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 152
  2⤵
  - Program crash
  PID:2224