21313c778e3bf137964d2269a5b8122a4ab3359a767c29bdb3ff48116f1f00df

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 13:26

Target

19f5eca59cbdd544f1178b12a9e1b5a6.exe
Size

124KB
MD5

19f5eca59cbdd544f1178b12a9e1b5a6
SHA1

821505f24a03e1cfdd349c4cbda57bf8e4ca0b83
SHA256

21313c778e3bf137964d2269a5b8122a4ab3359a767c29bdb3ff48116f1f00df
SHA512

cd0070677a560989023020c04bd389d15e80ca2fa851d02448c460767be298fd4c6333d6ca3b8da3964434bf9ee66dd8bc246ecbae4032d4d0baf9fc2fa8b0e8
SSDEEP

1536:x4M8uvTOPmw9vKqpqhMkyFazcFsmecgFZYk8eqk4+Syn+4zcGeONNep0mhvcVXzC:eMjTtw9AVyUoFjectO+geOzBtOZn4nK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	2072	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1728	2072	19f5eca59cbdd544f1178b12a9e1b5a6.exe	28
PID 2072 wrote to memory of 1728	2072	19f5eca59cbdd544f1178b12a9e1b5a6.exe	28
PID 2072 wrote to memory of 1728	2072	19f5eca59cbdd544f1178b12a9e1b5a6.exe	28
PID 2072 wrote to memory of 1728	2072	19f5eca59cbdd544f1178b12a9e1b5a6.exe	28

C:\Users\Admin\AppData\Local\Temp\19f5eca59cbdd544f1178b12a9e1b5a6.exe
"C:\Users\Admin\AppData\Local\Temp\19f5eca59cbdd544f1178b12a9e1b5a6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 36
  2⤵
  - Program crash
  PID:1728

memory/2072-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download