f84bdc8f026dbb56c2100f95551fd4847ac8f2389d5e2820649f651009744d53

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:07

Target

295f1f3d372ed0868a6457777dc59c10.exe
Size

76KB
MD5

295f1f3d372ed0868a6457777dc59c10
SHA1

6d15ca720f429ad1eedc1a6a21960509ac0f1b4a
SHA256

f84bdc8f026dbb56c2100f95551fd4847ac8f2389d5e2820649f651009744d53
SHA512

e646ccc0cbe17eb6537c8efeb63a5aa6b84600b85b8f16ecd71a1f7b922f24a38bdf050e67ffead2d958ab75a4c92c81e91a3ee5c97f7814411c6d65a4593689
SSDEEP

1536:K/ePyXHZ7DA4BfBrmTiXvvvUgbFNCuACP1DIgN:QeSHZ7DTBfBrB/UgbFNCuAq2C

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2388	1708	WerFault.exe	11

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2388	1708	295f1f3d372ed0868a6457777dc59c10.exe	28
PID 1708 wrote to memory of 2388	1708	295f1f3d372ed0868a6457777dc59c10.exe	28
PID 1708 wrote to memory of 2388	1708	295f1f3d372ed0868a6457777dc59c10.exe	28
PID 1708 wrote to memory of 2388	1708	295f1f3d372ed0868a6457777dc59c10.exe	28

C:\Users\Admin\AppData\Local\Temp\295f1f3d372ed0868a6457777dc59c10.exe
"C:\Users\Admin\AppData\Local\Temp\295f1f3d372ed0868a6457777dc59c10.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 108
  2⤵
  - Program crash
  PID:2388

memory/1708-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1708-1-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download