dd259eacb7f1570269c5f2e472030450f336b1060b2469a1ba252568f4082ec5

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 00:05

Target

2109ca7b60490060e0b1b5082eadad43.exe
Size

351KB
MD5

2109ca7b60490060e0b1b5082eadad43
SHA1

87958d475f059547f7fb91a0ac6e988ce7f365e3
SHA256

dd259eacb7f1570269c5f2e472030450f336b1060b2469a1ba252568f4082ec5
SHA512

72c3681ae18fb8a013ba9393d1d29257ed2692139eff775fa5387d9fc5d132791a6d49e6ce910556c1aefd10efff545d333e8efc1767350cf5f89f51217a7e0a
SSDEEP

6144:trGWR6WxfvPlAhyLXHFJYlEBVkg0s0/JgW+5d3+PpE2u1PiTfTClxS6:4AtvqMXjYEnU/eW+5UpY6/Ch

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2664	2404	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2664	2404	2109ca7b60490060e0b1b5082eadad43.exe	28
PID 2404 wrote to memory of 2664	2404	2109ca7b60490060e0b1b5082eadad43.exe	28
PID 2404 wrote to memory of 2664	2404	2109ca7b60490060e0b1b5082eadad43.exe	28
PID 2404 wrote to memory of 2664	2404	2109ca7b60490060e0b1b5082eadad43.exe	28

C:\Users\Admin\AppData\Local\Temp\2109ca7b60490060e0b1b5082eadad43.exe
"C:\Users\Admin\AppData\Local\Temp\2109ca7b60490060e0b1b5082eadad43.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 168
  2⤵
  - Program crash
  PID:2664

memory/2404-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2404-0-0x0000000000400000-0x00000000005C4000-memory.dmp

Filesize
1.8MB

Download
memory/2404-2-0x0000000000400000-0x00000000005C4000-memory.dmp

Filesize
1.8MB

Download