af15088fd7ed98032a5898bec9d13c23cd55a4daa57a357881938c1dc49d24a3

Analysis

max time kernel
121s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:39

Target

0ec7529e61dea1098d4092adeae94965.exe
Size

20KB
MD5

0ec7529e61dea1098d4092adeae94965
SHA1

e5efb857d4017d07486641fd49cd4872f6e5ffd2
SHA256

af15088fd7ed98032a5898bec9d13c23cd55a4daa57a357881938c1dc49d24a3
SHA512

e842bd3dbb716ae9ead63a7da0b130609a4aa88f6eb455236f74d82ff678733671b27905210a293b2d6beec04f1bb6172a0a5027f54477847a27f03c2cb90341
SSDEEP

384:hCmZ7QC9XpncHM0pdlmJycgla++RrYRdJpIMT5WfKGbj0Si1nu1:hCmFx9XpR0pTe9gcgJ951egSSu1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2736	2332	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2736	2332	0ec7529e61dea1098d4092adeae94965.exe	28
PID 2332 wrote to memory of 2736	2332	0ec7529e61dea1098d4092adeae94965.exe	28
PID 2332 wrote to memory of 2736	2332	0ec7529e61dea1098d4092adeae94965.exe	28
PID 2332 wrote to memory of 2736	2332	0ec7529e61dea1098d4092adeae94965.exe	28

C:\Users\Admin\AppData\Local\Temp\0ec7529e61dea1098d4092adeae94965.exe
"C:\Users\Admin\AppData\Local\Temp\0ec7529e61dea1098d4092adeae94965.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 88
  2⤵
  - Program crash
  PID:2736

memory/2332-0-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download