34e7b4ffec79dc71f8204b2b842d336d25892638c151e097b42eaaab9ffd072d

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:03

Target

2284c0e588a9fb9e3939d055adf8c718.exe
Size

321KB
MD5

2284c0e588a9fb9e3939d055adf8c718
SHA1

cfa753f19b8fcc3a81c1e604dc21ccf78f46f0a3
SHA256

34e7b4ffec79dc71f8204b2b842d336d25892638c151e097b42eaaab9ffd072d
SHA512

6839a32cd099f304bc8c9e9a68a966d597594806818d701e9c4537af66583ceb9670d014ee241b95627ba2ea2ad1d73ba5610afe504ef2f2cdd7f046388b74d5
SSDEEP

6144:OTj1OTEKnsub1upoH7td/tQqG56Prd3Z5NBA3r14lJDNIl:OFOoKnsub6oHprG5+3a7STY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2996	2448	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2996	2448	2284c0e588a9fb9e3939d055adf8c718.exe	28
PID 2448 wrote to memory of 2996	2448	2284c0e588a9fb9e3939d055adf8c718.exe	28
PID 2448 wrote to memory of 2996	2448	2284c0e588a9fb9e3939d055adf8c718.exe	28
PID 2448 wrote to memory of 2996	2448	2284c0e588a9fb9e3939d055adf8c718.exe	28

C:\Users\Admin\AppData\Local\Temp\2284c0e588a9fb9e3939d055adf8c718.exe
"C:\Users\Admin\AppData\Local\Temp\2284c0e588a9fb9e3939d055adf8c718.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 116
  2⤵
  - Program crash
  PID:2996

memory/2448-0-0x0000000001000000-0x0000000001055000-memory.dmp

Filesize
340KB

Download