90dc3f8f10068479a179e88b65e1422b593b0feb10de1aaf21def2f7a06ae45b

Analysis

max time kernel
121s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 01:59

Target

23a394523338518ece2fe94b4d180367.exe
Size

76KB
MD5

23a394523338518ece2fe94b4d180367
SHA1

9d019c97ba76b725005977be3903092102a72e55
SHA256

90dc3f8f10068479a179e88b65e1422b593b0feb10de1aaf21def2f7a06ae45b
SHA512

b44608f7b6144213da3b7d714dd76e101b2f3671bbe429b5946e9741c544c97d26db35819bf1b87fcecdfda157d1955b75423475ca5c81c6cc1f9f2356ced9f6
SSDEEP

1536:GiT+a5P8j2zRqmZWs9BolAl2kpLWBgPWr1WoA+sU/edhZKz/U85:Ga+iRH39xtQgPAA+5ekT5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2728	1404	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 2728	1404	23a394523338518ece2fe94b4d180367.exe	28
PID 1404 wrote to memory of 2728	1404	23a394523338518ece2fe94b4d180367.exe	28
PID 1404 wrote to memory of 2728	1404	23a394523338518ece2fe94b4d180367.exe	28
PID 1404 wrote to memory of 2728	1404	23a394523338518ece2fe94b4d180367.exe	28

C:\Users\Admin\AppData\Local\Temp\23a394523338518ece2fe94b4d180367.exe
"C:\Users\Admin\AppData\Local\Temp\23a394523338518ece2fe94b4d180367.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 36
  2⤵
  - Program crash
  PID:2728

memory/1404-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download