159f03f0e9838021b431fb558e8d579ec955792f926ecce3040e47c7e42b1c76

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 03:31

Target

26795faf0ae93cd9c88649b4da5c70df.exe
Size

381KB
MD5

26795faf0ae93cd9c88649b4da5c70df
SHA1

aca76bc8093bf5b0ef9ba1c2bb094fd1f9be9a7a
SHA256

159f03f0e9838021b431fb558e8d579ec955792f926ecce3040e47c7e42b1c76
SHA512

74d4b9b25cc622987ce7eb36bcc32478437effbc5d321435ab0d57cf6fc84b09ffe8cb985d35393c7f02a5e748663f64e16e3c54b211af69bfc5e192e5e823e7
SSDEEP

6144:MUo9fUZezDQTaL0uETjmRZ4k+ra4EJgWL529ByfJOJGhXoI/u:stHQxuETjmRGk+rIVN29BKJOJo4t

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2380	2248	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2380	2248	26795faf0ae93cd9c88649b4da5c70df.exe	16
PID 2248 wrote to memory of 2380	2248	26795faf0ae93cd9c88649b4da5c70df.exe	16
PID 2248 wrote to memory of 2380	2248	26795faf0ae93cd9c88649b4da5c70df.exe	16
PID 2248 wrote to memory of 2380	2248	26795faf0ae93cd9c88649b4da5c70df.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 196
1⤵
- Program crash
PID:2380

C:\Users\Admin\AppData\Local\Temp\26795faf0ae93cd9c88649b4da5c70df.exe
"C:\Users\Admin\AppData\Local\Temp\26795faf0ae93cd9c88649b4da5c70df.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2248

memory/2248-0-0x0000000000D20000-0x0000000000D5A000-memory.dmp

Filesize
232KB

Download