26f53e9b96638f7778f9b57240e31ad26cead5a3b9778589d7deaf30770ab6d9

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:06

Target

25bab0dd572ba0066f45d98e429f52ac.exe
Size

43KB
MD5

25bab0dd572ba0066f45d98e429f52ac
SHA1

4bd6674d87bf40963fe4acaf311e1e0f9538f8c6
SHA256

26f53e9b96638f7778f9b57240e31ad26cead5a3b9778589d7deaf30770ab6d9
SHA512

e8d543adcd666574cfd77052f4e417585a22318cf1d66e205f9fbc2f3de1a48286582f96eb82f5f9c7c569d90652a8343e6061e489436fbfeae88c74dfedc718
SSDEEP

768:lZl/kkg6D+T37K6dhjJ33knUWJgPoe9AHx1Z9+RUpu3myzkNvJoS4FXLn8q+Cz:1EMsVUnUWgAk2ZE3m2OOVD8TCz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1668	2024	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1668	2024	25bab0dd572ba0066f45d98e429f52ac.exe	28
PID 2024 wrote to memory of 1668	2024	25bab0dd572ba0066f45d98e429f52ac.exe	28
PID 2024 wrote to memory of 1668	2024	25bab0dd572ba0066f45d98e429f52ac.exe	28
PID 2024 wrote to memory of 1668	2024	25bab0dd572ba0066f45d98e429f52ac.exe	28

C:\Users\Admin\AppData\Local\Temp\25bab0dd572ba0066f45d98e429f52ac.exe
"C:\Users\Admin\AppData\Local\Temp\25bab0dd572ba0066f45d98e429f52ac.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 44
  2⤵
  - Program crash
  PID:1668

memory/2024-0-0x0000000000530000-0x0000000000554000-memory.dmp

Filesize
144KB

Download
memory/2024-1-0x0000000000220000-0x0000000000242000-memory.dmp

Filesize
136KB

Download
memory/2024-2-0x0000000000530000-0x0000000000554000-memory.dmp

Filesize
144KB

Download