109929d83ab94bdbff3189ac3afb338cc73ebfe4e9834cbda764c43f152f024e

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 00:21

Target

21808e44f756c83a5d5fd188e4dfc11f.exe
Size

64KB
MD5

21808e44f756c83a5d5fd188e4dfc11f
SHA1

11b1f5a32c5de9108521787306001070d6ee7f41
SHA256

109929d83ab94bdbff3189ac3afb338cc73ebfe4e9834cbda764c43f152f024e
SHA512

e52259e57a89d0465bc68af8e02d616cf0055125e874ced410b99d285699828ceb99a87f10f018c937a5f1d3515bdef67c9ba0ee90d467ea40bbb51084b8da92
SSDEEP

1536:j/TdK2nMz+guYr+y2PVPb88bDGKG9ofkmEr9EC+xD8VHW2LYsBMu/H1:j/TbiuYCNPVPY8bu0kB5+xD8YaN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2748	2452	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2748	2452	21808e44f756c83a5d5fd188e4dfc11f.exe	28
PID 2452 wrote to memory of 2748	2452	21808e44f756c83a5d5fd188e4dfc11f.exe	28
PID 2452 wrote to memory of 2748	2452	21808e44f756c83a5d5fd188e4dfc11f.exe	28
PID 2452 wrote to memory of 2748	2452	21808e44f756c83a5d5fd188e4dfc11f.exe	28

C:\Users\Admin\AppData\Local\Temp\21808e44f756c83a5d5fd188e4dfc11f.exe
"C:\Users\Admin\AppData\Local\Temp\21808e44f756c83a5d5fd188e4dfc11f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 140
  2⤵
  - Program crash
  PID:2748

memory/2452-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download