1db3e3c9a10b9c1644e70fdb4653f7ac8eddea5602e02b422059d89fae5b4b30

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 06:42

Target

11521ea9562c5a52d1440b0c258ac39f.exe
Size

118KB
MD5

11521ea9562c5a52d1440b0c258ac39f
SHA1

06dd8f052a8668d2b02e648f178ece5fd70c4f48
SHA256

1db3e3c9a10b9c1644e70fdb4653f7ac8eddea5602e02b422059d89fae5b4b30
SHA512

5cf938db811ac1ff3bf1cc44266ce827186d221b2f12219b40dbf1fc840792c640dc6d690be0a6541e4d7c7819d41bc47a2acc932c7e6b5cc6ab16879be28114
SSDEEP

1536:dbdo6pwas3BEBGviCxaOdHJTLusq/LpqXNWfBPLDFZLlKtrs/oWXZtS:db+uwZx3vij+JdK49WfhhKtA/Lu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
1832	1656	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1832	1656	11521ea9562c5a52d1440b0c258ac39f.exe	14
PID 1656 wrote to memory of 1832	1656	11521ea9562c5a52d1440b0c258ac39f.exe	14
PID 1656 wrote to memory of 1832	1656	11521ea9562c5a52d1440b0c258ac39f.exe	14
PID 1656 wrote to memory of 1832	1656	11521ea9562c5a52d1440b0c258ac39f.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 168
1⤵
- Program crash
PID:1832

C:\Users\Admin\AppData\Local\Temp\11521ea9562c5a52d1440b0c258ac39f.exe
"C:\Users\Admin\AppData\Local\Temp\11521ea9562c5a52d1440b0c258ac39f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656

memory/1656-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download