26f2fadf57107ffd210725a329380a052e1b6d2408eb0f0e8b978dfcf7a17fa0

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 00:27

Target

21abdf18cca6e6fc237c8cb47a887f9f.exe
Size

422KB
MD5

21abdf18cca6e6fc237c8cb47a887f9f
SHA1

515ccc695be40b828e103a99b76bc18d3f70e082
SHA256

26f2fadf57107ffd210725a329380a052e1b6d2408eb0f0e8b978dfcf7a17fa0
SHA512

4be1f9c46fb6e8a1dae6d525fda7ebd7909ace306e0997dc89b073b95a27f43742968626a757e0a16bc97098c8170a01a78e50dd823778b4ce40a8a02c4b7467
SSDEEP

12288:ysHIB7QkKRaug8yeikCykaAOl13l0Pz8MBqIp:ysHU7+h5yeilykkln0PzZBqIp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2368	2372	WerFault.exe	7

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2368	2372	21abdf18cca6e6fc237c8cb47a887f9f.exe	28
PID 2372 wrote to memory of 2368	2372	21abdf18cca6e6fc237c8cb47a887f9f.exe	28
PID 2372 wrote to memory of 2368	2372	21abdf18cca6e6fc237c8cb47a887f9f.exe	28
PID 2372 wrote to memory of 2368	2372	21abdf18cca6e6fc237c8cb47a887f9f.exe	28

C:\Users\Admin\AppData\Local\Temp\21abdf18cca6e6fc237c8cb47a887f9f.exe
"C:\Users\Admin\AppData\Local\Temp\21abdf18cca6e6fc237c8cb47a887f9f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 116
  2⤵
  - Program crash
  PID:2368

memory/2372-0-0x0000000000BC0000-0x0000000000C2D000-memory.dmp

Filesize
436KB

Download