14cf30671a73eb5459aaae6bae83b1d2260a9e4b6050e0814c21d1391cd46713

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 13:00

Target

19480a04981aa1e3c4872b092130f793.exe
Size

383KB
MD5

19480a04981aa1e3c4872b092130f793
SHA1

023b117017aea7b83d007f9f1e34b0fa50c64a82
SHA256

14cf30671a73eb5459aaae6bae83b1d2260a9e4b6050e0814c21d1391cd46713
SHA512

f8f249b2337541f26628d01f95c0ff7c1f1c1c4c6c9db520d1199620f3ffedab526651c25beac937560414eaaf3ad5d0bc4a1f77abedfb027ac2f60bc3df7544
SSDEEP

6144:3kDa7rq7qMzVOYgb6Y6veN4LOPX49QT/vBl4l8McOMOqFnDNg3inIVo42x:3k+7rqGMSbiveaLr9QT/w2McTpxgSIV4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2308	1152	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2308	1152	19480a04981aa1e3c4872b092130f793.exe	16
PID 1152 wrote to memory of 2308	1152	19480a04981aa1e3c4872b092130f793.exe	16
PID 1152 wrote to memory of 2308	1152	19480a04981aa1e3c4872b092130f793.exe	16
PID 1152 wrote to memory of 2308	1152	19480a04981aa1e3c4872b092130f793.exe	16

C:\Users\Admin\AppData\Local\Temp\19480a04981aa1e3c4872b092130f793.exe
"C:\Users\Admin\AppData\Local\Temp\19480a04981aa1e3c4872b092130f793.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 152
  2⤵
  - Program crash
  PID:2308

memory/1152-0-0x0000000001300000-0x0000000001337000-memory.dmp

Filesize
220KB

Download
memory/1152-1-0x0000000001300000-0x0000000001337000-memory.dmp

Filesize
220KB

Download