8f8a572dd1d4a035ee9fab29385779a204c5babef99eda58e41fd7dea53b9ff7

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 10:19

Target

15ade518e17736647ef6f63409ac113e.exe
Size

76KB
MD5

15ade518e17736647ef6f63409ac113e
SHA1

b1ab87ff47f082ac6d4dd36d4fec94205a9f1d36
SHA256

8f8a572dd1d4a035ee9fab29385779a204c5babef99eda58e41fd7dea53b9ff7
SHA512

8b6c3efe465781310ed9c4d253e2905b3b1b092bbbf1bba513f8c0dd6cdaf7e76f91787c743c728637e197db8d71476daa66ed494f8f22cad778228331553bae
SSDEEP

1536:3W777ctDkV4Chiu+/4FuUkVWfYxEawS+3epAkaHpeZpjVrs2ryrd1vUQuq6:pDkV4MVuUkVWQKbS+VJcHs2qo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2276	3012	WerFault.exe	11

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2276	3012	15ade518e17736647ef6f63409ac113e.exe	28
PID 3012 wrote to memory of 2276	3012	15ade518e17736647ef6f63409ac113e.exe	28
PID 3012 wrote to memory of 2276	3012	15ade518e17736647ef6f63409ac113e.exe	28
PID 3012 wrote to memory of 2276	3012	15ade518e17736647ef6f63409ac113e.exe	28

C:\Users\Admin\AppData\Local\Temp\15ade518e17736647ef6f63409ac113e.exe
"C:\Users\Admin\AppData\Local\Temp\15ade518e17736647ef6f63409ac113e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 36
  2⤵
  - Program crash
  PID:2276

memory/3012-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download