92310654aa96b61f636665e0fb2112adf1af2a96d88b5b9ea84569eb05797291

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:06

Target

11bbbaf12ac77e5140d045441d2c69bf.exe
Size

125KB
MD5

11bbbaf12ac77e5140d045441d2c69bf
SHA1

bb028d3068f6e36bb4ed5f5f7d09d904172361c8
SHA256

92310654aa96b61f636665e0fb2112adf1af2a96d88b5b9ea84569eb05797291
SHA512

e496e1968fe8c209ec81c4b257b74d532b518b1daf48c4b0336c8adca80b344114d74c037d35412af13592482c77d4656d104cc111a4463e0342be9bcc0e9504
SSDEEP

3072:LnJ26uk5gqsXb9bpLjQTZEON+awfMbwbNddf7wHx7hzDTXXwsSt:LnU6R5ebpksfMcDN7I7tvnwsS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
1880	2224	WerFault.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2236	2224	11bbbaf12ac77e5140d045441d2c69bf.exe	15
PID 2224 wrote to memory of 2236	2224	11bbbaf12ac77e5140d045441d2c69bf.exe	15
PID 2224 wrote to memory of 2236	2224	11bbbaf12ac77e5140d045441d2c69bf.exe	15
PID 2224 wrote to memory of 2236	2224	11bbbaf12ac77e5140d045441d2c69bf.exe	15
PID 2224 wrote to memory of 1880	2224	11bbbaf12ac77e5140d045441d2c69bf.exe	14
PID 2224 wrote to memory of 1880	2224	11bbbaf12ac77e5140d045441d2c69bf.exe	14
PID 2224 wrote to memory of 1880	2224	11bbbaf12ac77e5140d045441d2c69bf.exe	14
PID 2224 wrote to memory of 1880	2224	11bbbaf12ac77e5140d045441d2c69bf.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 48
1⤵
- Program crash
PID:1880

C:\Users\Admin\AppData\Local\Temp\11bbbaf12ac77e5140d045441d2c69bf.exe
"C:\Users\Admin\AppData\Local\Temp\11bbbaf12ac77e5140d045441d2c69bf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224

memory/2224-0-0x0000000000380000-0x00000000003C0000-memory.dmp

Filesize
256KB

Download
memory/2224-1-0x0000000000380000-0x00000000003C0000-memory.dmp

Filesize
256KB

Download