9c01d6961c548636c3a1b822a54ec0542cd16748e0adb81b64797fab77794d9c

Analysis

max time kernel
101s
max time network
45s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:03

Target

25a2745a4ee521f542ec8f551c91f8f7.exe
Size

129KB
MD5

25a2745a4ee521f542ec8f551c91f8f7
SHA1

8462cb30ae90b130d671b396d9b6fd1122552025
SHA256

9c01d6961c548636c3a1b822a54ec0542cd16748e0adb81b64797fab77794d9c
SHA512

6e9c261c540f9c7f2d7bb3a699e10109693b061e779831ee25d67320045ced42ad4ec7f2de99a94bdc3c13a77fd4c890d1fb25f7f1bf4610ca81ccc1d0ff5e30
SSDEEP

3072:tmR+115j8GaS6zxm3ZJknncGgriHb7K9QavVlHjevPZ:Yi5AGdoGfknBg618V4vPZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2820	2828	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2820	2828	25a2745a4ee521f542ec8f551c91f8f7.exe	27
PID 2828 wrote to memory of 2820	2828	25a2745a4ee521f542ec8f551c91f8f7.exe	27
PID 2828 wrote to memory of 2820	2828	25a2745a4ee521f542ec8f551c91f8f7.exe	27
PID 2828 wrote to memory of 2820	2828	25a2745a4ee521f542ec8f551c91f8f7.exe	27

C:\Users\Admin\AppData\Local\Temp\25a2745a4ee521f542ec8f551c91f8f7.exe
"C:\Users\Admin\AppData\Local\Temp\25a2745a4ee521f542ec8f551c91f8f7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 36
  2⤵
  - Program crash
  PID:2820

memory/2828-0-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download