79e04220ff249ac7a5bbd71a136dd45198bf44c603e5fd956dc9e79f0fe36412

Analysis

max time kernel
140s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 03:39

Target

26ac4e234771386a25002aed56ec0c83.exe
Size

43KB
MD5

26ac4e234771386a25002aed56ec0c83
SHA1

ba7b7dcde287db4c06bfe536b6bfaf44cec02fc4
SHA256

79e04220ff249ac7a5bbd71a136dd45198bf44c603e5fd956dc9e79f0fe36412
SHA512

0b1a8a3161cfb8b2b975b538545af137544a9c490079e002379bd9a076c058e055182289eb9fac8b64dd6904084b17cdb2625fcb3e7c3777eebadc070014fbdc
SSDEEP

768:062JRSgLvEaJ0bwo6fii2489ZWdX7gcaKaAEqYRiZRIfu3zjFI7/JX6iq3KRe5jB:05ygDEre8rWdX7kfAEqYiRy7xqTR5jMK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2936	2668	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2936	2668	26ac4e234771386a25002aed56ec0c83.exe	17
PID 2668 wrote to memory of 2936	2668	26ac4e234771386a25002aed56ec0c83.exe	17
PID 2668 wrote to memory of 2936	2668	26ac4e234771386a25002aed56ec0c83.exe	17
PID 2668 wrote to memory of 2936	2668	26ac4e234771386a25002aed56ec0c83.exe	17

C:\Users\Admin\AppData\Local\Temp\26ac4e234771386a25002aed56ec0c83.exe
"C:\Users\Admin\AppData\Local\Temp\26ac4e234771386a25002aed56ec0c83.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 164
  2⤵
  - Program crash
  PID:2936

memory/2668-0-0x0000000000420000-0x0000000000440000-memory.dmp

Filesize
128KB

Download
memory/2668-1-0x0000000000420000-0x0000000000440000-memory.dmp

Filesize
128KB

Download