38914a670fb1e3b7cff1404927ee9a7a4f674a3422511a87cb289c9b636b6e06

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:26

Target

0cec89fd5d63861b986416d1226d82a7.exe
Size

123KB
MD5

0cec89fd5d63861b986416d1226d82a7
SHA1

fc213cfaea5537d2f82313dd35dfc26fef7088c1
SHA256

38914a670fb1e3b7cff1404927ee9a7a4f674a3422511a87cb289c9b636b6e06
SHA512

6fce00a23867da700d190d2513cfa20d5059c38f91fdb8b146f2600e477ef3d9d97be46025d94f832d1c1a93359c74ca71aa9f5032c2923c7deb7ee8ba9ae32a
SSDEEP

3072:KByOfoxdSuAk08RajfqPmicNHjlKUmuKN5v05cFobvueTIQ:AyOfox4uOWPmb4PS5oEGc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1056	2512	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1056	2512	0cec89fd5d63861b986416d1226d82a7.exe	28
PID 2512 wrote to memory of 1056	2512	0cec89fd5d63861b986416d1226d82a7.exe	28
PID 2512 wrote to memory of 1056	2512	0cec89fd5d63861b986416d1226d82a7.exe	28
PID 2512 wrote to memory of 1056	2512	0cec89fd5d63861b986416d1226d82a7.exe	28

C:\Users\Admin\AppData\Local\Temp\0cec89fd5d63861b986416d1226d82a7.exe
"C:\Users\Admin\AppData\Local\Temp\0cec89fd5d63861b986416d1226d82a7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 36
  2⤵
  - Program crash
  PID:1056

memory/2512-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2512-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download