863cbe3a56be49add433cbdbc6bae91efbf6ae8908eeea7954bd15e6eb9ee0ad

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 13:27

Target

1a001bf258ac538f0f504dba1ae591bd.exe
Size

176KB
MD5

1a001bf258ac538f0f504dba1ae591bd
SHA1

0c978777a33b9411838843ea7cf5d6452d259f6f
SHA256

863cbe3a56be49add433cbdbc6bae91efbf6ae8908eeea7954bd15e6eb9ee0ad
SHA512

15551d488b7857e8ff71504a24ae37c8f097b731fb9bd103bc2ef304100881c6daac48ac755f2277fe4aa061e024438526b5829a8deaecee8adc71cf1934cf71
SSDEEP

1536:fVc0AoqGRw4/VStspwRhAkutYYPPZ5g8Xiaw3PV1qhp2p38T63q7VoagHa:t1q54/VNkuxPPZFXiawdI2p3Va7Voa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2656	2028	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2656	2028	1a001bf258ac538f0f504dba1ae591bd.exe	16
PID 2028 wrote to memory of 2656	2028	1a001bf258ac538f0f504dba1ae591bd.exe	16
PID 2028 wrote to memory of 2656	2028	1a001bf258ac538f0f504dba1ae591bd.exe	16
PID 2028 wrote to memory of 2656	2028	1a001bf258ac538f0f504dba1ae591bd.exe	16

C:\Users\Admin\AppData\Local\Temp\1a001bf258ac538f0f504dba1ae591bd.exe
"C:\Users\Admin\AppData\Local\Temp\1a001bf258ac538f0f504dba1ae591bd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 108
  2⤵
  - Program crash
  PID:2656

memory/2028-0-0x0000000000400000-0x00000000008A0000-memory.dmp

Filesize
4.6MB

Download