9a452b401a35e86ca2148b08983e525b2b3cebae0d767f2780bb7bfe73ad6471

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 21:23

Target

1ce001b10113a54933fae6a2727b0122.exe
Size

174KB
MD5

1ce001b10113a54933fae6a2727b0122
SHA1

cc6e4d391abbca1ef409f97557bde6e891f7861c
SHA256

9a452b401a35e86ca2148b08983e525b2b3cebae0d767f2780bb7bfe73ad6471
SHA512

0457d6411e2ce83fc153d239a8bafab72e9dd98476dc3023fbaa60171d173f1cbabfb74da34c6663dda84450a941555e3eea0c06d6a02a863d4d715ac37805cb
SSDEEP

3072:u8Zc0hTH53F/y0nzTd6UjIWVvn+o2GPvZyC+CTGUqThk281upzxZH0xo:e0XXzxHhvD+C6UWn5pzjT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
1732	1776	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1732	1776	1ce001b10113a54933fae6a2727b0122.exe	14
PID 1776 wrote to memory of 1732	1776	1ce001b10113a54933fae6a2727b0122.exe	14
PID 1776 wrote to memory of 1732	1776	1ce001b10113a54933fae6a2727b0122.exe	14
PID 1776 wrote to memory of 1732	1776	1ce001b10113a54933fae6a2727b0122.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 164
1⤵
- Program crash
PID:1732

C:\Users\Admin\AppData\Local\Temp\1ce001b10113a54933fae6a2727b0122.exe
"C:\Users\Admin\AppData\Local\Temp\1ce001b10113a54933fae6a2727b0122.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1776

memory/1776-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download