30e875fbfb86e1f0b0cb560f10ec21aad227820e150cb3d2654045a5105e9d0a

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:33

Target

124075847d65af7fa35a724e44d67922.exe
Size

115KB
MD5

124075847d65af7fa35a724e44d67922
SHA1

23cfca05bbd06e28663d9d060e5998b31bce7499
SHA256

30e875fbfb86e1f0b0cb560f10ec21aad227820e150cb3d2654045a5105e9d0a
SHA512

c8f9d77b92a90b6c207d7c5d7c5a0f9c56dd013c2a14b1c074179bf4afe77136d08889b9353b49fafd877e3a46bea467b4347fd510ce5112167258f02ba2e099
SSDEEP

1536:UkoAzrk0MkJaG3Tmi8eCWWAu4+y268gtZYL8637EZ3c:JRzrnMZG318eCWlkyB86ZY464O

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2804	2724	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2804	2724	124075847d65af7fa35a724e44d67922.exe	27
PID 2724 wrote to memory of 2804	2724	124075847d65af7fa35a724e44d67922.exe	27
PID 2724 wrote to memory of 2804	2724	124075847d65af7fa35a724e44d67922.exe	27
PID 2724 wrote to memory of 2804	2724	124075847d65af7fa35a724e44d67922.exe	27

C:\Users\Admin\AppData\Local\Temp\124075847d65af7fa35a724e44d67922.exe
"C:\Users\Admin\AppData\Local\Temp\124075847d65af7fa35a724e44d67922.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 132
  2⤵
  - Program crash
  PID:2804

memory/2724-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download