5419560f7ebb9df4ad697719bcbc606296a9a0b8d545ec185833379acb71df4d

Analysis

max time kernel
192s
max time network
37s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 12:19

Target

184ba0a2cf2ccca80f99eecdb554dd0c.exe
Size

1.9MB
MD5

184ba0a2cf2ccca80f99eecdb554dd0c
SHA1

27294f966c6a66032614368c63a1456af77befc5
SHA256

5419560f7ebb9df4ad697719bcbc606296a9a0b8d545ec185833379acb71df4d
SHA512

d3f6cbf783952acab1fb612fb06c3cacee57903b03389c9e26eb4cd75cfdc8bf90251fb33a16490c38528cbe6536f5e6c8f6b9a735202a5e76ebd56a3a9a09cc
SSDEEP

24576:XRmNIVyeNIVy2jUmNIVyeNIVy2jUq5NIVyeNIVy2jUmNIVyeNIVy2jUO:XRZyjeyjoyjeyjH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2564	2600	WerFault.exe	9

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2564	2600	184ba0a2cf2ccca80f99eecdb554dd0c.exe	29
PID 2600 wrote to memory of 2564	2600	184ba0a2cf2ccca80f99eecdb554dd0c.exe	29
PID 2600 wrote to memory of 2564	2600	184ba0a2cf2ccca80f99eecdb554dd0c.exe	29
PID 2600 wrote to memory of 2564	2600	184ba0a2cf2ccca80f99eecdb554dd0c.exe	29

C:\Users\Admin\AppData\Local\Temp\184ba0a2cf2ccca80f99eecdb554dd0c.exe
"C:\Users\Admin\AppData\Local\Temp\184ba0a2cf2ccca80f99eecdb554dd0c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 140
  2⤵
  - Program crash
  PID:2564

memory/2600-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2600-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download