7114d33d76354f3a0c6bb376c682a353c466d0aabb0a3a8e1766ac1b71a21a5d

Analysis

max time kernel
141s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:10

Target

240500ef8281124a2a34957aec437b51.exe
Size

132KB
MD5

240500ef8281124a2a34957aec437b51
SHA1

04b78232151e8e0688c7f7af7fafe7c6181a6ddd
SHA256

7114d33d76354f3a0c6bb376c682a353c466d0aabb0a3a8e1766ac1b71a21a5d
SHA512

163fbd15259c2b67bb66501af8347e2af96dee8c88456db39e5a79fef27f1556d36cfb4d78c2a03635a659934440a0ad77bd74091199d95f7baa989f1a6e03ff
SSDEEP

1536:vI17aKyOZ4p4zvBfURL/Sp8xYsMajY411a7Ea6mmDn+SW8JJlLDDeEb3cckXf6Ki:g1r++voTpYsI41s91gs8JL7/EexkgSd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1932	2088	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1932	2088	240500ef8281124a2a34957aec437b51.exe	28
PID 2088 wrote to memory of 1932	2088	240500ef8281124a2a34957aec437b51.exe	28
PID 2088 wrote to memory of 1932	2088	240500ef8281124a2a34957aec437b51.exe	28
PID 2088 wrote to memory of 1932	2088	240500ef8281124a2a34957aec437b51.exe	28

C:\Users\Admin\AppData\Local\Temp\240500ef8281124a2a34957aec437b51.exe
"C:\Users\Admin\AppData\Local\Temp\240500ef8281124a2a34957aec437b51.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 36
  2⤵
  - Program crash
  PID:1932

memory/2088-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download