77edc424cfad1aff767adf015e7dee60c3aa6aaddad05efd341f6afd9793fb7d

Analysis

max time kernel
194s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 14:10

Target

1b0e079201899fbe66ec70680a4f33d1.exe
Size

47KB
MD5

1b0e079201899fbe66ec70680a4f33d1
SHA1

5e36d17178fc09e84a77d0a4bb27c3a8c2d2e063
SHA256

77edc424cfad1aff767adf015e7dee60c3aa6aaddad05efd341f6afd9793fb7d
SHA512

21b02bc6283f24a29255283a09bb862c503458635678941f74d3a06081b554fb0fc99f57935d02aa4a119c5c70d123bb1ec72595358b42fbe32b7688410edc19
SSDEEP

768:uqrPejL1KJuHhhDTZQ1bpp4W2MtLdzNCRE7VQasreDWxNv+vBapAo96FQF9mx:uaejRpDDFip4W2MfzMS7yCkN3pAnSsx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2276	2564	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2276	2564	1b0e079201899fbe66ec70680a4f33d1.exe	29
PID 2564 wrote to memory of 2276	2564	1b0e079201899fbe66ec70680a4f33d1.exe	29
PID 2564 wrote to memory of 2276	2564	1b0e079201899fbe66ec70680a4f33d1.exe	29
PID 2564 wrote to memory of 2276	2564	1b0e079201899fbe66ec70680a4f33d1.exe	29

C:\Users\Admin\AppData\Local\Temp\1b0e079201899fbe66ec70680a4f33d1.exe
"C:\Users\Admin\AppData\Local\Temp\1b0e079201899fbe66ec70680a4f33d1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 136
  2⤵
  - Program crash
  PID:2276

memory/2564-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2564-1-0x0000000000220000-0x0000000000225000-memory.dmp

Filesize
20KB

Download
memory/2564-2-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download