e1ece72fd21ffd6e158adae9a7f17b261dbb7a522d36ea82e472e74d10c99163

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:03

Target

23c6288b5cdda8d68e4dc76f8428de48.exe
Size

20KB
MD5

23c6288b5cdda8d68e4dc76f8428de48
SHA1

2b4274213a8f3398429621e0d33dd609e0969ef5
SHA256

e1ece72fd21ffd6e158adae9a7f17b261dbb7a522d36ea82e472e74d10c99163
SHA512

54032db5d1fb61c59290e186c532bd4e9bd474665c768d5f373b4221b0a2e4fec542880ed034ef3a388ca3d8979b302721b3a761edc9cad8f8c8dba92d5eee08
SSDEEP

384:l1fCsBojwlFZERLy5ZPg85jNZnOlKr+HmerfEoOjiY/c3C:nOWAyfTcPHmCfEo0cy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2372	1096	WerFault.exe	22

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 2372	1096	23c6288b5cdda8d68e4dc76f8428de48.exe	28
PID 1096 wrote to memory of 2372	1096	23c6288b5cdda8d68e4dc76f8428de48.exe	28
PID 1096 wrote to memory of 2372	1096	23c6288b5cdda8d68e4dc76f8428de48.exe	28
PID 1096 wrote to memory of 2372	1096	23c6288b5cdda8d68e4dc76f8428de48.exe	28

C:\Users\Admin\AppData\Local\Temp\23c6288b5cdda8d68e4dc76f8428de48.exe
"C:\Users\Admin\AppData\Local\Temp\23c6288b5cdda8d68e4dc76f8428de48.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 88
  2⤵
  - Program crash
  PID:2372

memory/1096-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download