36ba5281391b8a9b45620f14ba8cbcf6b35b653149bf82290e39c3704d6fa14f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:21

Target

0b797215ccbd64f9649b8789f170ac06.exe
Size

1.1MB
MD5

0b797215ccbd64f9649b8789f170ac06
SHA1

97dc1229c3144b6d53385304b2cde1ce6152fdfe
SHA256

36ba5281391b8a9b45620f14ba8cbcf6b35b653149bf82290e39c3704d6fa14f
SHA512

f1c0d3fe608184cbed27ee738f867d08b29fd55ef663aad588d24738c2fee074ad2cc308f8e4cd9278aebec284f771a0309a6d2089fcfecd84ea7784056fb55e
SSDEEP

12288:l+VLFLEsCM4yMa6rGZ5xCCpRQNU06zmSpT02L7ixCjWoZ60yVOZo8E:iqMrMa245R+U06zZA2U6Dm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2176	2724	WerFault.exe	2

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2176	2724	0b797215ccbd64f9649b8789f170ac06.exe	22
PID 2724 wrote to memory of 2176	2724	0b797215ccbd64f9649b8789f170ac06.exe	22
PID 2724 wrote to memory of 2176	2724	0b797215ccbd64f9649b8789f170ac06.exe	22
PID 2724 wrote to memory of 2176	2724	0b797215ccbd64f9649b8789f170ac06.exe	22

C:\Users\Admin\AppData\Local\Temp\0b797215ccbd64f9649b8789f170ac06.exe
"C:\Users\Admin\AppData\Local\Temp\0b797215ccbd64f9649b8789f170ac06.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 668
  2⤵
  - Program crash
  PID:2176

memory/2724-0-0x0000000000880000-0x000000000099A000-memory.dmp

Filesize
1.1MB

Download
memory/2724-1-0x0000000074120000-0x000000007480E000-memory.dmp

Filesize
6.9MB

Download
memory/2724-2-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2724-3-0x0000000074120000-0x000000007480E000-memory.dmp

Filesize
6.9MB

Download
memory/2724-4-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download