88151745837a64d6a744c9fc8369e8104b32fc6a68979e3ce5b2c6f85d650ca9

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:08

Target

25c87f338fb1ea9746732ff333f7aad9.exe
Size

422KB
MD5

25c87f338fb1ea9746732ff333f7aad9
SHA1

24ee0b2430f059fb3e78677fe7be83866fbc28cf
SHA256

88151745837a64d6a744c9fc8369e8104b32fc6a68979e3ce5b2c6f85d650ca9
SHA512

749eba5d446df0daa224c1f1f20ec59f450258e1fd38c3b82dee6f77b008a6aa594f99fc9b474a50731651a82cba10eee956adc1afd0d7a9da40710b154b808e
SSDEEP

6144:ykB1INZdWaFzaE7mDGg7Y4+MFyBPys80G5sEOi9Ri9na5UVx3:ykBgdW/E7mDGg8xMkBp80GiZa5UVh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2728	1576	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 2728	1576	25c87f338fb1ea9746732ff333f7aad9.exe	17
PID 1576 wrote to memory of 2728	1576	25c87f338fb1ea9746732ff333f7aad9.exe	17
PID 1576 wrote to memory of 2728	1576	25c87f338fb1ea9746732ff333f7aad9.exe	17
PID 1576 wrote to memory of 2728	1576	25c87f338fb1ea9746732ff333f7aad9.exe	17

C:\Users\Admin\AppData\Local\Temp\25c87f338fb1ea9746732ff333f7aad9.exe
"C:\Users\Admin\AppData\Local\Temp\25c87f338fb1ea9746732ff333f7aad9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 116
  2⤵
  - Program crash
  PID:2728

memory/1576-0-0x00000000009E0000-0x0000000000A4E000-memory.dmp

Filesize
440KB

Download