61e72ff31cbe734d5ce3e2476a6b92fe002df5ca4074bf9b019fd61ca0c667f9

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 12:56

Target

19307e668c143aa7695dca93f258d895.exe
Size

25KB
MD5

19307e668c143aa7695dca93f258d895
SHA1

785f08258a063cc4d675d9ddb679f1729ee2bfa2
SHA256

61e72ff31cbe734d5ce3e2476a6b92fe002df5ca4074bf9b019fd61ca0c667f9
SHA512

75c4fee451a3357736893a6c985237009650b6cff1cc55be9058ef1d003231959f21bef9e2344d23b2e8b217bf6aa9a08b61b843c5332fb3affb5f1d4840add4
SSDEEP

768:UZFO4CWYw9fq76dUxQe+nEUMM9CpdPSAvi1e1lbG:gHL9u6dqQe1UMM9CHPSAviE1lS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1740	2232	WerFault.exe	6

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1740	2232	19307e668c143aa7695dca93f258d895.exe	28
PID 2232 wrote to memory of 1740	2232	19307e668c143aa7695dca93f258d895.exe	28
PID 2232 wrote to memory of 1740	2232	19307e668c143aa7695dca93f258d895.exe	28
PID 2232 wrote to memory of 1740	2232	19307e668c143aa7695dca93f258d895.exe	28

C:\Users\Admin\AppData\Local\Temp\19307e668c143aa7695dca93f258d895.exe
"C:\Users\Admin\AppData\Local\Temp\19307e668c143aa7695dca93f258d895.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 64
  2⤵
  - Program crash
  PID:1740