e85cc924848dd26c6eafe6f383b952cbf5e1ba6579e62ee7c8e4cd24284b1e26

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 10:58

Target

169140b1df52f10890e23fc1af41ed1a.exe
Size

116KB
MD5

169140b1df52f10890e23fc1af41ed1a
SHA1

43f7557dac684d07cbe992b00faa39bf0f2058c0
SHA256

e85cc924848dd26c6eafe6f383b952cbf5e1ba6579e62ee7c8e4cd24284b1e26
SHA512

010c97a8e7e3bd9a28920db805eeebbb59620ef0e6b380f66a43816ff03618acc43aaa6455ac7871d2e98015786661d4de45c7f0679bfd35aafaed231ee75506
SSDEEP

1536:8np5ckkXUjQaHjGKOQ53Wb4reDg0Ul9BIsP2qMUv+Tf4uB4A/AqeJ7Bk96hA92h8:vh0yOmbyeE0ExFMZviBhA92h/0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2532	2928	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2532	2928	169140b1df52f10890e23fc1af41ed1a.exe	14
PID 2928 wrote to memory of 2532	2928	169140b1df52f10890e23fc1af41ed1a.exe	14
PID 2928 wrote to memory of 2532	2928	169140b1df52f10890e23fc1af41ed1a.exe	14
PID 2928 wrote to memory of 2532	2928	169140b1df52f10890e23fc1af41ed1a.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 36
1⤵
- Program crash
PID:2532

C:\Users\Admin\AppData\Local\Temp\169140b1df52f10890e23fc1af41ed1a.exe
"C:\Users\Admin\AppData\Local\Temp\169140b1df52f10890e23fc1af41ed1a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928

memory/2928-2-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2928-1-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2928-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download