af264dd5cfaad981d1d9428fb7366219bb1890655e5fef710fd608ed252da220

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:33

Target

268867493e570ba764c97379860f9b70.exe
Size

2.3MB
MD5

268867493e570ba764c97379860f9b70
SHA1

fe33abd6c967b16d188fab234acc867e85dbc99d
SHA256

af264dd5cfaad981d1d9428fb7366219bb1890655e5fef710fd608ed252da220
SHA512

af71b4915e9bb78ac0bd0adf359bf2790e95ca0b2b8442af01a05fbc30e1680ac02b9d29bad60e80acb83def6ad0bd2b5d0621b5e6a2de4b4c7b4d1cc0046ca2
SSDEEP

49152:VEWSqWuLIBqm2YB4AGic2OlLaW4/ciebrtv8Ipjgg+nCM1jL3qE33lPH+SUx0xl:V9SqWuLIBqm2sGn2OlLaWViEGIpjgg6B

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2040	3040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2040	3040	268867493e570ba764c97379860f9b70.exe	28
PID 3040 wrote to memory of 2040	3040	268867493e570ba764c97379860f9b70.exe	28
PID 3040 wrote to memory of 2040	3040	268867493e570ba764c97379860f9b70.exe	28
PID 3040 wrote to memory of 2040	3040	268867493e570ba764c97379860f9b70.exe	28

C:\Users\Admin\AppData\Local\Temp\268867493e570ba764c97379860f9b70.exe
"C:\Users\Admin\AppData\Local\Temp\268867493e570ba764c97379860f9b70.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 232
  2⤵
  - Program crash
  PID:2040

memory/3040-0-0x0000000000D20000-0x0000000000F76000-memory.dmp

Filesize
2.3MB

Download