46dfad348e446fa1b9fef8ea64c9badae3e596c8dac0ec70898ec7ccdc89e250

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:05

Target

11b6832caaecbe05cefb869faf4c71e8.exe
Size

102KB
MD5

11b6832caaecbe05cefb869faf4c71e8
SHA1

3ac6688da570c249c3790906bdb484fe28391a62
SHA256

46dfad348e446fa1b9fef8ea64c9badae3e596c8dac0ec70898ec7ccdc89e250
SHA512

ed41a6fa77b68e2a7d7f116d7171c9e669312c0ef4b6a9e289e5206caf3b621614e20d59905214057777f8ec989c8d05cd2ea1fa3198a63c28fe15f2597f2e05
SSDEEP

1536:aS9km6KZ8ZAxB6IY1u2uuCeiMTEcGTsI/QDzNx62wlf0jfgLR1H:mmz8ZuB6JYqX7VA/w62wVnLR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2216	2100	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2216	2100	11b6832caaecbe05cefb869faf4c71e8.exe	28
PID 2100 wrote to memory of 2216	2100	11b6832caaecbe05cefb869faf4c71e8.exe	28
PID 2100 wrote to memory of 2216	2100	11b6832caaecbe05cefb869faf4c71e8.exe	28
PID 2100 wrote to memory of 2216	2100	11b6832caaecbe05cefb869faf4c71e8.exe	28

C:\Users\Admin\AppData\Local\Temp\11b6832caaecbe05cefb869faf4c71e8.exe
"C:\Users\Admin\AppData\Local\Temp\11b6832caaecbe05cefb869faf4c71e8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 168
  2⤵
  - Program crash
  PID:2216

memory/2100-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download