13c33346d63127f3c8789dd79799ae8c058ec46353334db911fb6c9c52ef37fc

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:47

Target

0c20e8b8563cb2a810f483ffcc9b2cdc.exe
Size

14KB
MD5

0c20e8b8563cb2a810f483ffcc9b2cdc
SHA1

9b8a172b6405dbcc2b2c56fc83c04299622144e1
SHA256

13c33346d63127f3c8789dd79799ae8c058ec46353334db911fb6c9c52ef37fc
SHA512

ac26fabb8e72b1eedbef0119e29d7a6182d186fd3e6616fe9299ab8bd7673b065b66d64455cfd66dee63d80ad514a9221dc1daa9ce9638d82253befef8a34a4c
SSDEEP

192:7J9D8AN7Oy4Lu1OIhshHop3EC+1AMwuEA7p/7dLqNfpG+Xlw2ByV1bkQFUMf:7J9D8ABLp1jwtCXMwuEA7dW3GeAzkGz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1060	1204	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1060	1204	0c20e8b8563cb2a810f483ffcc9b2cdc.exe	28
PID 1204 wrote to memory of 1060	1204	0c20e8b8563cb2a810f483ffcc9b2cdc.exe	28
PID 1204 wrote to memory of 1060	1204	0c20e8b8563cb2a810f483ffcc9b2cdc.exe	28
PID 1204 wrote to memory of 1060	1204	0c20e8b8563cb2a810f483ffcc9b2cdc.exe	28

C:\Users\Admin\AppData\Local\Temp\0c20e8b8563cb2a810f483ffcc9b2cdc.exe
"C:\Users\Admin\AppData\Local\Temp\0c20e8b8563cb2a810f483ffcc9b2cdc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 88
  2⤵
  - Program crash
  PID:1060

memory/1204-0-0x00000000001B0000-0x00000000001B3000-memory.dmp

Filesize
12KB

Download