39aa3e5f53375ab67cea5cd5905cbde9639cb75b75cf0d601a0e88d6e00076c7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:00

Target

22712b3b72d6f8c09a9fadb0def88786.exe
Size

76KB
MD5

22712b3b72d6f8c09a9fadb0def88786
SHA1

1c647b08d09a82cbf5a23ed73457dc098aa913d1
SHA256

39aa3e5f53375ab67cea5cd5905cbde9639cb75b75cf0d601a0e88d6e00076c7
SHA512

9deba53f951eddd29b0189fa683e0526d6c8c4479df31658925f8b76eb3a1e909382dd6db699b257b14661f1f6452ef8b8229d3e625a6dd75599cfa969b4cab1
SSDEEP

1536:7HycqGWLsFwu28M+34EtlbhG3Lw225y5NfkZC3zGwj+pjVrs2ryrd1vUQuq6:7HyLGau2LnEtlbhG022In8ZCDGwyHs2N

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1984	2028	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1984	2028	22712b3b72d6f8c09a9fadb0def88786.exe	16
PID 2028 wrote to memory of 1984	2028	22712b3b72d6f8c09a9fadb0def88786.exe	16
PID 2028 wrote to memory of 1984	2028	22712b3b72d6f8c09a9fadb0def88786.exe	16
PID 2028 wrote to memory of 1984	2028	22712b3b72d6f8c09a9fadb0def88786.exe	16

C:\Users\Admin\AppData\Local\Temp\22712b3b72d6f8c09a9fadb0def88786.exe
"C:\Users\Admin\AppData\Local\Temp\22712b3b72d6f8c09a9fadb0def88786.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 36
  2⤵
  - Program crash
  PID:1984

memory/2028-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download