0a244f576e7241de6d3145eda0e94375be7919479826316ca0943a71e9e9e371

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:53

Target

2379c0080d8def684c094ccf5cb0e649.exe
Size

75KB
MD5

2379c0080d8def684c094ccf5cb0e649
SHA1

f825744d9278396416a3b4b267d5a0826ce6107e
SHA256

0a244f576e7241de6d3145eda0e94375be7919479826316ca0943a71e9e9e371
SHA512

a1594f0825d9e3232fbe7e2cb588db22259d7c51ef74a3f68fb0984b4704ea15ce0fa3bb4a3d0611a6b8ebd0d72d121fb8c865f43b6fdcb694e7a8421c008d76
SSDEEP

1536:9OY499DAG7T7P8e6sL+AmWzNzRPOWLK6AoTtBaBCO8lrJYCRLC:954Dn7vv62mWRzgcAoTtBzRrYCRLC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2316	2264	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2316	2264	2379c0080d8def684c094ccf5cb0e649.exe	16
PID 2264 wrote to memory of 2316	2264	2379c0080d8def684c094ccf5cb0e649.exe	16
PID 2264 wrote to memory of 2316	2264	2379c0080d8def684c094ccf5cb0e649.exe	16
PID 2264 wrote to memory of 2316	2264	2379c0080d8def684c094ccf5cb0e649.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 92
1⤵
- Program crash
PID:2316

C:\Users\Admin\AppData\Local\Temp\2379c0080d8def684c094ccf5cb0e649.exe
"C:\Users\Admin\AppData\Local\Temp\2379c0080d8def684c094ccf5cb0e649.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2264

memory/2264-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download