ba008655a7d57fb1f94dc635d9d389578253b5b7eb57aa63859c581e815855c1

Analysis

max time kernel
141s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 08:46

Target

13b0ee8cadebae1e40172a77b542e528.exe
Size

369KB
MD5

13b0ee8cadebae1e40172a77b542e528
SHA1

b6a3661410dee398bf3a08aa3e751e0621ddbc69
SHA256

ba008655a7d57fb1f94dc635d9d389578253b5b7eb57aa63859c581e815855c1
SHA512

dbe65866f5500d2724b73790e33de442350b104eb30379d1a0c9752ad33e16c377e10188b84b24d45dfcee4e06d7509ec8d3777de72a06798e7933c206d2a02f
SSDEEP

6144:ZxOTaiBUdAnkeWlYtjAVcLme/slAAkGQ7sDnCtDqlwjdLTES7RSM9OYNzB1JDIdw:ZxmLpWitkS0SAw72nCt2i5dSavJDIdod

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	1268	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 1728	1268	13b0ee8cadebae1e40172a77b542e528.exe	28
PID 1268 wrote to memory of 1728	1268	13b0ee8cadebae1e40172a77b542e528.exe	28
PID 1268 wrote to memory of 1728	1268	13b0ee8cadebae1e40172a77b542e528.exe	28
PID 1268 wrote to memory of 1728	1268	13b0ee8cadebae1e40172a77b542e528.exe	28

C:\Users\Admin\AppData\Local\Temp\13b0ee8cadebae1e40172a77b542e528.exe
"C:\Users\Admin\AppData\Local\Temp\13b0ee8cadebae1e40172a77b542e528.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 188
  2⤵
  - Program crash
  PID:1728

memory/1268-0-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/1268-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1268-2-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download