e9bb580f8e400339b345b14455abe8745dcbd00e47c2642c7150784c89a214e6

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:08

Target

25cb5f451aadf47cb4916fa07d3b0d97.exe
Size

172KB
MD5

25cb5f451aadf47cb4916fa07d3b0d97
SHA1

b5a7daa2ee60a8ff7568035fcef06abed597a19b
SHA256

e9bb580f8e400339b345b14455abe8745dcbd00e47c2642c7150784c89a214e6
SHA512

890210363a12db33e91f9c0f77d93acc630b5f2f4c4743916ad01bb04c39e81f7324b89d6bbe9c55310970c516d4a9a33f4018862f16505443bc4aeb46b6e751
SSDEEP

3072:5NxAACgetX3tqU62rjKfO9hshsPtERf9Frm8BXTJZ+56FETWrzzOF8:7xBvMX768KmfXm1pBDJwTU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2196	2520	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2196	2520	25cb5f451aadf47cb4916fa07d3b0d97.exe	28
PID 2520 wrote to memory of 2196	2520	25cb5f451aadf47cb4916fa07d3b0d97.exe	28
PID 2520 wrote to memory of 2196	2520	25cb5f451aadf47cb4916fa07d3b0d97.exe	28
PID 2520 wrote to memory of 2196	2520	25cb5f451aadf47cb4916fa07d3b0d97.exe	28

C:\Users\Admin\AppData\Local\Temp\25cb5f451aadf47cb4916fa07d3b0d97.exe
"C:\Users\Admin\AppData\Local\Temp\25cb5f451aadf47cb4916fa07d3b0d97.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 148
  2⤵
  - Program crash
  PID:2196

memory/2520-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2520-1-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download