3ac1c145ab70b244ba3e4037df2678116a0ffd4ce2a030fc50d81b4098332094

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:10

Target

24004bd6124413874d6b6f6e8ccc9c7b.exe
Size

76KB
MD5

24004bd6124413874d6b6f6e8ccc9c7b
SHA1

4e279f727ad7fbfc81f8ecf1a4c7c3232ce08757
SHA256

3ac1c145ab70b244ba3e4037df2678116a0ffd4ce2a030fc50d81b4098332094
SHA512

5f5f22a309bbfac47d111eec7f9e7bff171ea08182016188ad1a637dac4cece947b62b316ad163d7b30be83645d6b6b514335f9731e41340e1382d439e94375c
SSDEEP

1536:djnUl8BNth6X0U9tw1oU+sGRPkBujEErxTWDTMqhGKYIZTET8x:VnUO3to0SEoU+sycAjBkMqhGKZTbx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2868	2548	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2868	2548	24004bd6124413874d6b6f6e8ccc9c7b.exe	16
PID 2548 wrote to memory of 2868	2548	24004bd6124413874d6b6f6e8ccc9c7b.exe	16
PID 2548 wrote to memory of 2868	2548	24004bd6124413874d6b6f6e8ccc9c7b.exe	16
PID 2548 wrote to memory of 2868	2548	24004bd6124413874d6b6f6e8ccc9c7b.exe	16

C:\Users\Admin\AppData\Local\Temp\24004bd6124413874d6b6f6e8ccc9c7b.exe
"C:\Users\Admin\AppData\Local\Temp\24004bd6124413874d6b6f6e8ccc9c7b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 36
  2⤵
  - Program crash
  PID:2868

memory/2548-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download