6275431103aee099fc2f03f69dd5b87f922f1769ed5a59b6301cde3cb9aa6e0d

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 02:45

Target

2502990cd60006043b95943aa55732b9.exe
Size

117KB
MD5

2502990cd60006043b95943aa55732b9
SHA1

02d7897e72830074f3baf2429ccdcfd5ce2b64e7
SHA256

6275431103aee099fc2f03f69dd5b87f922f1769ed5a59b6301cde3cb9aa6e0d
SHA512

6003412dad6b6588bb94738995b7295cced3e4aa883e9c3da0e25f5cd43cdd97e47d02c8cb3c624dd5e4ebeaf9ed4a286f00371a06d782d2ad62e225ef991f10
SSDEEP

1536:E8J5kj1AH2OOuwoZlF6LSk5C99Hkoq22q/fNnzOyf9CzzPc2xhXFYDSykVsbOI:E8J51H2OLt7IWLkoiIfFzJ2zUefuZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2528	1752	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2528	1752	2502990cd60006043b95943aa55732b9.exe	16
PID 1752 wrote to memory of 2528	1752	2502990cd60006043b95943aa55732b9.exe	16
PID 1752 wrote to memory of 2528	1752	2502990cd60006043b95943aa55732b9.exe	16
PID 1752 wrote to memory of 2528	1752	2502990cd60006043b95943aa55732b9.exe	16

C:\Users\Admin\AppData\Local\Temp\2502990cd60006043b95943aa55732b9.exe
"C:\Users\Admin\AppData\Local\Temp\2502990cd60006043b95943aa55732b9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 36
  2⤵
  - Program crash
  PID:2528

memory/1752-0-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download