32bad9867d0c1b8855fa812b3c257c0edfa9a294d67f9a8d518819d1dd905c27

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 20:42

Target

1c0c66856b825157c3448edfca5e5b2b.exe
Size

41KB
MD5

1c0c66856b825157c3448edfca5e5b2b
SHA1

9e69142b68538e48b0306d074b01c6c2b19325db
SHA256

32bad9867d0c1b8855fa812b3c257c0edfa9a294d67f9a8d518819d1dd905c27
SHA512

5850248806095a128ccf12e14ea416e0c20346e1bc913cd720c30ad25db96c40dd6b1f3778b3821aba168f1d115b33132dee7fc389cb9eb9258c6aab2e81d5be
SSDEEP

768:ltLxvBs3hvzeVb/psixkvJ7rIxgF+Lb3SNjL5c21ZSyFEtM+1qndNPa26CgWQp:6zMOi2vJ7ag6ML5AyCtM1viC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2680	2996	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2680	2996	1c0c66856b825157c3448edfca5e5b2b.exe	28
PID 2996 wrote to memory of 2680	2996	1c0c66856b825157c3448edfca5e5b2b.exe	28
PID 2996 wrote to memory of 2680	2996	1c0c66856b825157c3448edfca5e5b2b.exe	28
PID 2996 wrote to memory of 2680	2996	1c0c66856b825157c3448edfca5e5b2b.exe	28

C:\Users\Admin\AppData\Local\Temp\1c0c66856b825157c3448edfca5e5b2b.exe
"C:\Users\Admin\AppData\Local\Temp\1c0c66856b825157c3448edfca5e5b2b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 44
  2⤵
  - Program crash
  PID:2680

memory/2996-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download