445d35bee43447b3776da17695033b4d34233f3fb42d35e1a4b60b6d29813371

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:12

Target

0b40eb35498c4b8618df652e19812f5d.exe
Size

21KB
MD5

0b40eb35498c4b8618df652e19812f5d
SHA1

2ec5222dad8a0737a3bc7f7d0339e06fc9512522
SHA256

445d35bee43447b3776da17695033b4d34233f3fb42d35e1a4b60b6d29813371
SHA512

20194adf84e508f8eeb84566f88754090e37a2512b43460089c71830099a9778f8cde43fdad65e32806b93445eabc4d5841b7d4cb1e9e548b9e8081bc325bc0c
SSDEEP

384:BSlgQcaIoqpDgg7SUse81A6PyU6eDbkUHn6YYjHTB7Xh+LMcAL:Vtg7Ua1A66ADbtHtYf5hrcE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1804	2796	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 1804	2796	0b40eb35498c4b8618df652e19812f5d.exe	20
PID 2796 wrote to memory of 1804	2796	0b40eb35498c4b8618df652e19812f5d.exe	20
PID 2796 wrote to memory of 1804	2796	0b40eb35498c4b8618df652e19812f5d.exe	20
PID 2796 wrote to memory of 1804	2796	0b40eb35498c4b8618df652e19812f5d.exe	20

C:\Users\Admin\AppData\Local\Temp\0b40eb35498c4b8618df652e19812f5d.exe
"C:\Users\Admin\AppData\Local\Temp\0b40eb35498c4b8618df652e19812f5d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 88
  2⤵
  - Program crash
  PID:1804

memory/2796-0-0x00000000001B0000-0x00000000001B3000-memory.dmp

Filesize
12KB

Download