ddadbc46ce6b9d9428f7b269a854a8c6a427c7658ed70595c913a655817bb2e5

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:56

Target

0c44d0384b76f32ff4b1b2cae0255fc1.exe
Size

84KB
MD5

0c44d0384b76f32ff4b1b2cae0255fc1
SHA1

fe0b70403349d9fa46499cb6cd94d39bdbd5a97a
SHA256

ddadbc46ce6b9d9428f7b269a854a8c6a427c7658ed70595c913a655817bb2e5
SHA512

1331581d3bdb73b646c6e3249160d3ace1d5013191f598fec7d2d1dba2ed2ced6871dc565a614bdc2507e0c1a8df18ce0cd449aaa0bbf8a0c466af7dcd55ab20
SSDEEP

1536:lYdAf1796dHRwEVy1ZuJvm/jQ2rWyj3rk9tUPwQChFA+doL9vX02qilKLTLDQU:lYdA196dHRKTPWg2UlCGvXRKLDQU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1536	2372	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1536	2372	0c44d0384b76f32ff4b1b2cae0255fc1.exe	28
PID 2372 wrote to memory of 1536	2372	0c44d0384b76f32ff4b1b2cae0255fc1.exe	28
PID 2372 wrote to memory of 1536	2372	0c44d0384b76f32ff4b1b2cae0255fc1.exe	28
PID 2372 wrote to memory of 1536	2372	0c44d0384b76f32ff4b1b2cae0255fc1.exe	28

C:\Users\Admin\AppData\Local\Temp\0c44d0384b76f32ff4b1b2cae0255fc1.exe
"C:\Users\Admin\AppData\Local\Temp\0c44d0384b76f32ff4b1b2cae0255fc1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 88
  2⤵
  - Program crash
  PID:1536

memory/2372-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2372-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2372-2-0x00000000001B0000-0x00000000001B6000-memory.dmp

Filesize
24KB

Download
memory/2372-3-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download