0ca9dd400ed2f2aeb5e765353bd1a29827b9b8f8e2a115d008f9cbde463fbab6

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 00:26

Target

21a88cd22df52d857d8e970173f18f16.exe
Size

293KB
MD5

21a88cd22df52d857d8e970173f18f16
SHA1

c3c9255a1645b131ec9799c0021f05305e2aaa82
SHA256

0ca9dd400ed2f2aeb5e765353bd1a29827b9b8f8e2a115d008f9cbde463fbab6
SHA512

d99d45b4a8eb8affe2c1ce44e60e1e952c890b6c816516e6253150d68bf6a440a9e8ddf009701ec1bae94e76168800cec406cfa23d6ddc1d4a86451cc3a7540a
SSDEEP

6144:MPdMoMANEVzGlcEDUl4qaRYVQSJTGbusJRhgnGXc2D7Xm2BeddhMHGB0K:cNEh8cSLqdlsisDhgnGBBBedDMmBj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1832	624	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 1832	624	21a88cd22df52d857d8e970173f18f16.exe	28
PID 624 wrote to memory of 1832	624	21a88cd22df52d857d8e970173f18f16.exe	28
PID 624 wrote to memory of 1832	624	21a88cd22df52d857d8e970173f18f16.exe	28
PID 624 wrote to memory of 1832	624	21a88cd22df52d857d8e970173f18f16.exe	28

C:\Users\Admin\AppData\Local\Temp\21a88cd22df52d857d8e970173f18f16.exe
"C:\Users\Admin\AppData\Local\Temp\21a88cd22df52d857d8e970173f18f16.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 140
  2⤵
  - Program crash
  PID:1832

memory/624-0-0x0000000000490000-0x00000000004D1000-memory.dmp

Filesize
260KB

Download
memory/624-1-0x00000000004E0000-0x000000000052B000-memory.dmp

Filesize
300KB

Download