10bd6e1417eb8e43b1c98f4c376e68f29e22cfb5fd6e7f01a709df541238de52

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 13:55

Target

1ab27671b2bb0acf26f2a7dc11358d84.exe
Size

427KB
MD5

1ab27671b2bb0acf26f2a7dc11358d84
SHA1

e75ef486a84eb4e9bbd3322d2b90730d328b341a
SHA256

10bd6e1417eb8e43b1c98f4c376e68f29e22cfb5fd6e7f01a709df541238de52
SHA512

4d8ab9297fb949281d763d97af9cbca9a4b909364440ba0fcd10c972d96e16bf34a6f55181423b40e5bb8ff5ac2cac0252f7fcc585b40d10418313dfe308629b
SSDEEP

12288:1gI1CsEaMt9A2MHVuYR8yf/PobvBpky3YLSnQwMUYXEi7y:1zk9Ab8w8y3Pob2oQor

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1572	2480	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 1572	2480	1ab27671b2bb0acf26f2a7dc11358d84.exe	28
PID 2480 wrote to memory of 1572	2480	1ab27671b2bb0acf26f2a7dc11358d84.exe	28
PID 2480 wrote to memory of 1572	2480	1ab27671b2bb0acf26f2a7dc11358d84.exe	28
PID 2480 wrote to memory of 1572	2480	1ab27671b2bb0acf26f2a7dc11358d84.exe	28

C:\Users\Admin\AppData\Local\Temp\1ab27671b2bb0acf26f2a7dc11358d84.exe
"C:\Users\Admin\AppData\Local\Temp\1ab27671b2bb0acf26f2a7dc11358d84.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 168
  2⤵
  - Program crash
  PID:1572

memory/2480-0-0x00000000010A0000-0x00000000010E3000-memory.dmp

Filesize
268KB

Download
memory/2480-1-0x00000000010A0000-0x00000000010E3000-memory.dmp

Filesize
268KB

Download