e6d782f67855f75034e917becd48a4becc69453d0c5b562f89c090b0f34ded46

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:00

Target

2581d5c878a64a4bab889dc227f3201d.exe
Size

100KB
MD5

2581d5c878a64a4bab889dc227f3201d
SHA1

62db0678e836a323ca78771cdb7858d08c125a3f
SHA256

e6d782f67855f75034e917becd48a4becc69453d0c5b562f89c090b0f34ded46
SHA512

1df5e97ee2fa3f2d4040c5bd2a249ff1e1bc0dc65a8806d176e4b22a9c69502e3fc6729928ded10fef5d263d62d3bf46d9d4c88cbb12a3e70a3c92547dc4ae58
SSDEEP

1536:EW/IXA0Cl1Jce7dByKw5iElj8lUl76+o918HMQ57XXU9Yvt0/LKsmPvBTwE59n6b:EGUw5d5woEJ8WQ+o96HM0XU+aDe5UEju

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1680	2192	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1680	2192	2581d5c878a64a4bab889dc227f3201d.exe	15
PID 2192 wrote to memory of 1680	2192	2581d5c878a64a4bab889dc227f3201d.exe	15
PID 2192 wrote to memory of 1680	2192	2581d5c878a64a4bab889dc227f3201d.exe	15
PID 2192 wrote to memory of 1680	2192	2581d5c878a64a4bab889dc227f3201d.exe	15

C:\Users\Admin\AppData\Local\Temp\2581d5c878a64a4bab889dc227f3201d.exe
"C:\Users\Admin\AppData\Local\Temp\2581d5c878a64a4bab889dc227f3201d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 148
  2⤵
  - Program crash
  PID:1680

memory/2192-0-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2192-1-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download