9aa42d84695772848d50cd74e0d0452175d4e71e6f905d6c5cde21b0af2eafe6

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:33

Target

268834ea1a7c764398b5bb4debc73bb0.exe
Size

37KB
MD5

268834ea1a7c764398b5bb4debc73bb0
SHA1

8a51118dea66a3f47f887f73a4865734980b542c
SHA256

9aa42d84695772848d50cd74e0d0452175d4e71e6f905d6c5cde21b0af2eafe6
SHA512

fd1e7f084779ba4ccaf6f05c367b5f752a366b77bc2c34e00304e15c8946285dcfb6d90f69a3c5614ee6df37c65431825d866a134f3cc4464aac2aca5f4e26a6
SSDEEP

768:+cEWMW7JqjuEqGkabjg7znwoVPQ35D4vwlR5mV8L1:+cGVqGka3g3nwoVY35gwdTB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2064	1080	WerFault.exe	13

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 2064	1080	268834ea1a7c764398b5bb4debc73bb0.exe	28
PID 1080 wrote to memory of 2064	1080	268834ea1a7c764398b5bb4debc73bb0.exe	28
PID 1080 wrote to memory of 2064	1080	268834ea1a7c764398b5bb4debc73bb0.exe	28
PID 1080 wrote to memory of 2064	1080	268834ea1a7c764398b5bb4debc73bb0.exe	28
PID 1080 wrote to memory of 2064	1080	268834ea1a7c764398b5bb4debc73bb0.exe	28
PID 1080 wrote to memory of 2064	1080	268834ea1a7c764398b5bb4debc73bb0.exe	28
PID 1080 wrote to memory of 2064	1080	268834ea1a7c764398b5bb4debc73bb0.exe	28

C:\Users\Admin\AppData\Local\Temp\268834ea1a7c764398b5bb4debc73bb0.exe
"C:\Users\Admin\AppData\Local\Temp\268834ea1a7c764398b5bb4debc73bb0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 256
  2⤵
  - Program crash
  PID:2064

memory/1080-0-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download