eafb6b661474c21efa0c6d9f16b8bdb55399778cd57e1aa71c7efbd78b6b3785

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:27

Target

28224c098ed3292ad04a05b73ec4d391.exe
Size

222KB
MD5

28224c098ed3292ad04a05b73ec4d391
SHA1

e516997d04b9f55407e3ac064f30ad559bd95207
SHA256

eafb6b661474c21efa0c6d9f16b8bdb55399778cd57e1aa71c7efbd78b6b3785
SHA512

5254ec2998dfc23288c97270f4cf17c219d3e4fb01c1600158512c25b77af6f2e79f7dcbb57f39fa67d9966f362af3472d0c3bd673db081c4419075fb4b3a278
SSDEEP

6144:tB6Im3lgv4UYCTGwCwibHsa+W/foR9+lHdgUNRjUd:t8IJqwCw6sa+W/gilGUjjUd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2636	2232	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2636	2232	28224c098ed3292ad04a05b73ec4d391.exe	16
PID 2232 wrote to memory of 2636	2232	28224c098ed3292ad04a05b73ec4d391.exe	16
PID 2232 wrote to memory of 2636	2232	28224c098ed3292ad04a05b73ec4d391.exe	16
PID 2232 wrote to memory of 2636	2232	28224c098ed3292ad04a05b73ec4d391.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 92
1⤵
- Program crash
PID:2636

C:\Users\Admin\AppData\Local\Temp\28224c098ed3292ad04a05b73ec4d391.exe
"C:\Users\Admin\AppData\Local\Temp\28224c098ed3292ad04a05b73ec4d391.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232