7c165cd65676d2df85c36c8e9eec1d699d859319535b470a94255a1bafb5491b

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:34

Target

0d1cdf731d7e4ad7d156f1e1e72151aa.exe
Size

209KB
MD5

0d1cdf731d7e4ad7d156f1e1e72151aa
SHA1

aa367ee39d8f7c12c39256b7c9b5325d74b2c553
SHA256

7c165cd65676d2df85c36c8e9eec1d699d859319535b470a94255a1bafb5491b
SHA512

7e48dda3be9f66fe6b72d6a48a597b8584468ca499da1e15efec9ed121eee2d3de4b8802ed9e81f57c240d55ec235c7417a9033efe15efb1cfebe8829f1164a9
SSDEEP

3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL++Ofu4pLthEjQT6n:/lZtbLWIgd1LZ9oECZbDlUd++OWkEjR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2376	2856	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2376	2856	0d1cdf731d7e4ad7d156f1e1e72151aa.exe	28
PID 2856 wrote to memory of 2376	2856	0d1cdf731d7e4ad7d156f1e1e72151aa.exe	28
PID 2856 wrote to memory of 2376	2856	0d1cdf731d7e4ad7d156f1e1e72151aa.exe	28
PID 2856 wrote to memory of 2376	2856	0d1cdf731d7e4ad7d156f1e1e72151aa.exe	28

C:\Users\Admin\AppData\Local\Temp\0d1cdf731d7e4ad7d156f1e1e72151aa.exe
"C:\Users\Admin\AppData\Local\Temp\0d1cdf731d7e4ad7d156f1e1e72151aa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 164
  2⤵
  - Program crash
  PID:2376

memory/2856-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download