b3813dc06e983990e5a528fab668fb2da8346049e517073a1f96607e92937075

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 13:21

Target

19cead8de8c187005ad9f26594049c82.exe
Size

24KB
MD5

19cead8de8c187005ad9f26594049c82
SHA1

1a9fc4c637cee68ed29544e212fc8db77355639f
SHA256

b3813dc06e983990e5a528fab668fb2da8346049e517073a1f96607e92937075
SHA512

ea2acda8f6471ed96d95b12f5f201964d9e5219f634f26c0fb8f327fa9633271d9a7b1af48d07fcb84daf37f5745a25f739ed003f7ff5ba011ff167c18fbc66f
SSDEEP

384:vqk2vDlqDglEJLe7SIjXejCvFi5mqnDVo8+ZvOcTGNDqoYuC3gOod87:Sk2uglENcSI7eOvun4OcTGNI3FodA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2828	2640	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2828	2640	19cead8de8c187005ad9f26594049c82.exe	28
PID 2640 wrote to memory of 2828	2640	19cead8de8c187005ad9f26594049c82.exe	28
PID 2640 wrote to memory of 2828	2640	19cead8de8c187005ad9f26594049c82.exe	28
PID 2640 wrote to memory of 2828	2640	19cead8de8c187005ad9f26594049c82.exe	28

C:\Users\Admin\AppData\Local\Temp\19cead8de8c187005ad9f26594049c82.exe
"C:\Users\Admin\AppData\Local\Temp\19cead8de8c187005ad9f26594049c82.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 140
  2⤵
  - Program crash
  PID:2828

memory/2640-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2640-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2640-2-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2640-3-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download