65bee6b27a8b33ff528a916ee91fac442e2d15168aac398c2289cc86487f1a2a

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 03:05

Target

25afe03f7943697864bbef3d17ecd656.exe
Size

45KB
MD5

25afe03f7943697864bbef3d17ecd656
SHA1

236b73eb7b47540f8cd5b0667050d4538227a9d3
SHA256

65bee6b27a8b33ff528a916ee91fac442e2d15168aac398c2289cc86487f1a2a
SHA512

287c17deff4adddc689dea0a39c915845c15925071d1e8d9374b223b598eee5489db229788659f1745bc7777aaea70e3094d96df49107302d0a76386da565e0d
SSDEEP

768:VpZgVRbunWjb9jCNbBAbAQJlOYA6z8Xmr43m3DLAczz4Gz9jwuCjdvKraK9:SInE9jCB8AQJlOYAtWwGLo890uCR8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2996	2940	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2996	2940	25afe03f7943697864bbef3d17ecd656.exe	28
PID 2940 wrote to memory of 2996	2940	25afe03f7943697864bbef3d17ecd656.exe	28
PID 2940 wrote to memory of 2996	2940	25afe03f7943697864bbef3d17ecd656.exe	28
PID 2940 wrote to memory of 2996	2940	25afe03f7943697864bbef3d17ecd656.exe	28

C:\Users\Admin\AppData\Local\Temp\25afe03f7943697864bbef3d17ecd656.exe
"C:\Users\Admin\AppData\Local\Temp\25afe03f7943697864bbef3d17ecd656.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 88
  2⤵
  - Program crash
  PID:2996

memory/2940-1-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2940-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download