7adc25850aedb4eeb8beef63d4ed849a60c92fac6c27ae1bebe5da5093bddb15

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:03

Target

2b0d85be195e1942f7899a3209ab550a.exe
Size

367KB
MD5

2b0d85be195e1942f7899a3209ab550a
SHA1

d9006597587a3dada32cf2b4a32cf79b38487139
SHA256

7adc25850aedb4eeb8beef63d4ed849a60c92fac6c27ae1bebe5da5093bddb15
SHA512

916e72c36b7decd7c7c182d3940434b7528ddc5b47f5328624c130e0f5d9c4b1d0e93da46c7bd2d6cc29a1ebeb57dff87462d566ace58f61fb40942d658b456a
SSDEEP

6144:WITkBXkHQYwikxUSOkuvvWik2SN1K8sdIw69dct47hyl0kNr8stZ5/68:mjCtvvWj9Lw63ct47hy5xr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2988	1272	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 2988	1272	2b0d85be195e1942f7899a3209ab550a.exe	14
PID 1272 wrote to memory of 2988	1272	2b0d85be195e1942f7899a3209ab550a.exe	14
PID 1272 wrote to memory of 2988	1272	2b0d85be195e1942f7899a3209ab550a.exe	14
PID 1272 wrote to memory of 2988	1272	2b0d85be195e1942f7899a3209ab550a.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 148
1⤵
- Program crash
PID:2988

C:\Users\Admin\AppData\Local\Temp\2b0d85be195e1942f7899a3209ab550a.exe
"C:\Users\Admin\AppData\Local\Temp\2b0d85be195e1942f7899a3209ab550a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1272