f0153429fc48526f6e3e0135b183936f1475346e0310d9220d59b8398ddcdc33

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:07

Target

2b2ff29cdd9200461b208538037c1a40.exe
Size

24KB
MD5

2b2ff29cdd9200461b208538037c1a40
SHA1

a17907190185b8ba00576d463eaa041e7bdebb3e
SHA256

f0153429fc48526f6e3e0135b183936f1475346e0310d9220d59b8398ddcdc33
SHA512

5953a8266befd7d0bb36a729a2ce6c4ccd1576c710ee17a8c88121c5e839b06e673bf1ea8ee42c4fee467a9c3352060ed6436f605f86ed9b1f7c0e0ebb99be5d
SSDEEP

384:QtlddHXXTU5ryNKW0S3JdYUm3zFtJTPttsN2K1KRo7KJFIpFBe:GdHTzIW9Jmj91WNbCo2JF2be

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2420	2964	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2420	2964	2b2ff29cdd9200461b208538037c1a40.exe	14
PID 2964 wrote to memory of 2420	2964	2b2ff29cdd9200461b208538037c1a40.exe	14
PID 2964 wrote to memory of 2420	2964	2b2ff29cdd9200461b208538037c1a40.exe	14
PID 2964 wrote to memory of 2420	2964	2b2ff29cdd9200461b208538037c1a40.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 88
1⤵
- Program crash
PID:2420

C:\Users\Admin\AppData\Local\Temp\2b2ff29cdd9200461b208538037c1a40.exe
"C:\Users\Admin\AppData\Local\Temp\2b2ff29cdd9200461b208538037c1a40.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964

memory/2964-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download