4dfc4c0924cfc620184cdfc7c9384f5a952097085145c653ac1056f74c8eca0a

Analysis

max time kernel
202s
max time network
156s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 07:14

Target

2cf863f20025e6595a5a9469b508c73d.exe
Size

39KB
MD5

2cf863f20025e6595a5a9469b508c73d
SHA1

78a8d800eaec97db4fe040a3b096af960941e1da
SHA256

4dfc4c0924cfc620184cdfc7c9384f5a952097085145c653ac1056f74c8eca0a
SHA512

8c28ec8cabf63f2941212284218de01b43852df9c3bd09ed17cc9e835d4ddd99330d043ec03e68c330f93eeaa108d1b993be0c51bb7626dfb64b1c863f02c686
SSDEEP

768:7wWFWX3HW3eVKppOmfBfsEM6gme7fpxKjAIeJQBrxSzNJhSFj8xR14aLEj:fWXXXViDBtM6wxKsIHrxwhyj8xRqaL+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
596	2616	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 596	2616	2cf863f20025e6595a5a9469b508c73d.exe	29
PID 2616 wrote to memory of 596	2616	2cf863f20025e6595a5a9469b508c73d.exe	29
PID 2616 wrote to memory of 596	2616	2cf863f20025e6595a5a9469b508c73d.exe	29
PID 2616 wrote to memory of 596	2616	2cf863f20025e6595a5a9469b508c73d.exe	29

C:\Users\Admin\AppData\Local\Temp\2cf863f20025e6595a5a9469b508c73d.exe
"C:\Users\Admin\AppData\Local\Temp\2cf863f20025e6595a5a9469b508c73d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 88
  2⤵
  - Program crash
  PID:596

memory/2616-0-0x0000000013140000-0x0000000013154000-memory.dmp

Filesize
80KB

Download
memory/2616-1-0x0000000013140000-0x0000000013154000-memory.dmp

Filesize
80KB

Download
memory/2616-2-0x00000000002E0000-0x00000000002E9000-memory.dmp

Filesize
36KB

Download
memory/2616-3-0x0000000013140000-0x0000000013154000-memory.dmp

Filesize
80KB

Download
memory/2616-4-0x0000000013140000-0x0000000013154000-memory.dmp

Filesize
80KB

Download