a7dcbbb4e5d036f11d5037fee16c384dafa12b40dcde9753d2f0438992b6515d

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 00:17

Target

21639f71cbe2470c5720c279431b0c4d.exe
Size

26KB
MD5

21639f71cbe2470c5720c279431b0c4d
SHA1

12cd4a797b92221cb55d05aa5671e0dc0939cc54
SHA256

a7dcbbb4e5d036f11d5037fee16c384dafa12b40dcde9753d2f0438992b6515d
SHA512

0e9978176c352021c1239e210ec29af4b7b36853f10a668071fcf3a008f8ce465b51843f3a3f9c4e33e3de6e5a6360ffc4dab96254e678199b73aeb718d16e81
SSDEEP

384:r6vhfYA2cnU7/nO2NkhTzOGVZKKCAeJ+zO2+h3b3TIUhQ/DXHeaWQVAuC:qni2DVPEKCAwJNr3TIU27+aWQV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2908	3028	WerFault.exe	1

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*	21639f71cbe2470c5720c279431b0c4d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\DocumentInfo = "71"	21639f71cbe2470c5720c279431b0c4d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2908	3028	21639f71cbe2470c5720c279431b0c4d.exe	16
PID 3028 wrote to memory of 2908	3028	21639f71cbe2470c5720c279431b0c4d.exe	16
PID 3028 wrote to memory of 2908	3028	21639f71cbe2470c5720c279431b0c4d.exe	16
PID 3028 wrote to memory of 2908	3028	21639f71cbe2470c5720c279431b0c4d.exe	16

C:\Users\Admin\AppData\Local\Temp\21639f71cbe2470c5720c279431b0c4d.exe
"C:\Users\Admin\AppData\Local\Temp\21639f71cbe2470c5720c279431b0c4d.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 152
  2⤵
  - Program crash
  PID:2908

memory/3028-2-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/3028-1-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download