e02293d16f45aa9aa25bc0bc3075763660645ce6e129085e51a21aa8e63ee803

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:13

Target

2988e6dfad74675cf26c377950cdf5aa.exe
Size

43KB
MD5

2988e6dfad74675cf26c377950cdf5aa
SHA1

7e6a838f71931d7265f269eaa94ef26c17e91e6f
SHA256

e02293d16f45aa9aa25bc0bc3075763660645ce6e129085e51a21aa8e63ee803
SHA512

d23fa001be4970b417503952de235a0871a12829ce3ea08a60103e3bfb1e3d7c1a22e5bd4955d98e7632584e663db522c5b0b3b825eea57844c0ca852a994b8f
SSDEEP

768:t11ZzWAsRNqMxfXt+eCrnyafB/e+lN9oX7zzvG3z1Gsm8KrFLLBxLdeV:t11ZzWBFd47I+lof2X+F

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1588	2644	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 1588	2644	2988e6dfad74675cf26c377950cdf5aa.exe	28
PID 2644 wrote to memory of 1588	2644	2988e6dfad74675cf26c377950cdf5aa.exe	28
PID 2644 wrote to memory of 1588	2644	2988e6dfad74675cf26c377950cdf5aa.exe	28
PID 2644 wrote to memory of 1588	2644	2988e6dfad74675cf26c377950cdf5aa.exe	28

C:\Users\Admin\AppData\Local\Temp\2988e6dfad74675cf26c377950cdf5aa.exe
"C:\Users\Admin\AppData\Local\Temp\2988e6dfad74675cf26c377950cdf5aa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 88
  2⤵
  - Program crash
  PID:1588

memory/2644-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download