2ff2f0b2cbe16722a5b1df424ea375c787a6dafc69fe2293da67926db810dffc

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:09

Target

2795f44b3cc74640e0620a894c3ee290.exe
Size

14KB
MD5

2795f44b3cc74640e0620a894c3ee290
SHA1

a9d2a940db9f8aca77f5a2f75d66939769d01ef2
SHA256

2ff2f0b2cbe16722a5b1df424ea375c787a6dafc69fe2293da67926db810dffc
SHA512

942cbb4bce650a04ab6023f1258d21daa85fca830165ed83b919d38bdad58a4f8483aec0625fec8b1efe0573547e80dc5b7c1694d2c151a301ea52933e09ee0f
SSDEEP

192:nks61A/0LiwxqfKD6Vk/gqWhiQ7Sh92sGNl+vnTJQjcWm2aT4:7x0iwxqsRQmh92tl+/NAzm1T4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2104	2968	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2104	2968	2795f44b3cc74640e0620a894c3ee290.exe	16
PID 2968 wrote to memory of 2104	2968	2795f44b3cc74640e0620a894c3ee290.exe	16
PID 2968 wrote to memory of 2104	2968	2795f44b3cc74640e0620a894c3ee290.exe	16
PID 2968 wrote to memory of 2104	2968	2795f44b3cc74640e0620a894c3ee290.exe	16

C:\Users\Admin\AppData\Local\Temp\2795f44b3cc74640e0620a894c3ee290.exe
"C:\Users\Admin\AppData\Local\Temp\2795f44b3cc74640e0620a894c3ee290.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 96
  2⤵
  - Program crash
  PID:2104

memory/2968-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download