91e4d63701494bfb30acf705ed064520e44b7cb31c4d52f9f324ff810b810ab9

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 09:42 UTC

Target

14ca2ad35a61d32040684a11bbd193e7.exe
Size

429KB
MD5

14ca2ad35a61d32040684a11bbd193e7
SHA1

6ecb441e2295627f62aa75164ce366499f846750
SHA256

91e4d63701494bfb30acf705ed064520e44b7cb31c4d52f9f324ff810b810ab9
SHA512

51afca1f6dad69bc5f09fdde02ad7783361c8c0ccd6d12c1ad8cd92144599760748c214cde9834d05f45ee92698eacd96b5754fba1c824f006bcc02cc539d6f6
SSDEEP

6144:AYbWW2WDmyUUqK5EhEMDMg48Td50WKtNvGRNxw8QUYK:AhWjmyUUqK5j030TyNC8Q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2320	1476	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 2320	1476	14ca2ad35a61d32040684a11bbd193e7.exe	28
PID 1476 wrote to memory of 2320	1476	14ca2ad35a61d32040684a11bbd193e7.exe	28
PID 1476 wrote to memory of 2320	1476	14ca2ad35a61d32040684a11bbd193e7.exe	28
PID 1476 wrote to memory of 2320	1476	14ca2ad35a61d32040684a11bbd193e7.exe	28

C:\Users\Admin\AppData\Local\Temp\14ca2ad35a61d32040684a11bbd193e7.exe
"C:\Users\Admin\AppData\Local\Temp\14ca2ad35a61d32040684a11bbd193e7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 116
  2⤵
  - Program crash
  PID:2320

memory/1476-0-0x0000000000AC0000-0x0000000000B30000-memory.dmp

Filesize
448KB

Download