b47e9e6d47cfd196024bf49603d8b537f2de1194582ae7adbd39eddff49c66c4

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 14:12

Target

1b1705acd22d3d033941f1d8f0d0cb73.exe
Size

429KB
MD5

1b1705acd22d3d033941f1d8f0d0cb73
SHA1

032e64264c5ff6c088345c2e66348617a0316db3
SHA256

b47e9e6d47cfd196024bf49603d8b537f2de1194582ae7adbd39eddff49c66c4
SHA512

413bf52453e7b326cc9f0333f27d93df15b9456d5b4b9ab4e1c673cf79f4bb6941f99b5516ea648cd0273667293a99a6554d08b34a5a58043ccafc7f580a7485
SSDEEP

6144:N5XxfAcSD3Dty9ZCOfVavfqfS5cNIdVQXc9PUgzdPOKg2mUHClWqtdyf/:r9hSDTtyu2Ivz5cN8z5UgzdSpPtdyf/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2868	2548	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2868	2548	1b1705acd22d3d033941f1d8f0d0cb73.exe	16
PID 2548 wrote to memory of 2868	2548	1b1705acd22d3d033941f1d8f0d0cb73.exe	16
PID 2548 wrote to memory of 2868	2548	1b1705acd22d3d033941f1d8f0d0cb73.exe	16
PID 2548 wrote to memory of 2868	2548	1b1705acd22d3d033941f1d8f0d0cb73.exe	16

C:\Users\Admin\AppData\Local\Temp\1b1705acd22d3d033941f1d8f0d0cb73.exe
"C:\Users\Admin\AppData\Local\Temp\1b1705acd22d3d033941f1d8f0d0cb73.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 148
  2⤵
  - Program crash
  PID:2868

memory/2548-0-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download