e9da822c86f988ce8d4dc8067d7ec9238b19b978e2841391a8474aa26acf4926

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:24

Target

0cdc5994af95800ffff856264ddd45d4.exe
Size

64KB
MD5

0cdc5994af95800ffff856264ddd45d4
SHA1

f2d67167a2a7a7a1767a33629d0b19f6f0023d13
SHA256

e9da822c86f988ce8d4dc8067d7ec9238b19b978e2841391a8474aa26acf4926
SHA512

87fc2a3cbc2dfe7e2495e80637adf98db139fdacb4c91c3a246b9da47ff84281bbf8b103621320192223670cee74724c614e0d50c1c4a9db9ea1077f700f65a8
SSDEEP

768:iQlHRQCATb6cKgE/qfdYI7LDJXUnQ3aJKxgo+GYZRg0sos9GhKF2n3dVdkooWZX:dGboHIjJT3Wn607lMF23ToI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1612	2256	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 1612	2256	0cdc5994af95800ffff856264ddd45d4.exe	29
PID 2256 wrote to memory of 1612	2256	0cdc5994af95800ffff856264ddd45d4.exe	29
PID 2256 wrote to memory of 1612	2256	0cdc5994af95800ffff856264ddd45d4.exe	29
PID 2256 wrote to memory of 1612	2256	0cdc5994af95800ffff856264ddd45d4.exe	29

C:\Users\Admin\AppData\Local\Temp\0cdc5994af95800ffff856264ddd45d4.exe
"C:\Users\Admin\AppData\Local\Temp\0cdc5994af95800ffff856264ddd45d4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 128
  2⤵
  - Program crash
  PID:1612