f8a03ac431ceecc76e1f3af12ea948c3da3c057b5f0449f0474d5bb02933c58f

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:55

Target

2c62ee8a2a75daa0e436c91a1a479155.exe
Size

52KB
MD5

2c62ee8a2a75daa0e436c91a1a479155
SHA1

2ab886b656fbf2750685fa225471865ecd21c9e2
SHA256

f8a03ac431ceecc76e1f3af12ea948c3da3c057b5f0449f0474d5bb02933c58f
SHA512

e2fb3f25b565792d7d8dff123e91e6fd28c09a86f678508855a21375043b373eca3cb6d1f2571f025f80ef18cd5a69076e3e67ef355421cdc8a7fd396dea16a7
SSDEEP

768:RUEMjlLXFqG2q6DXjCGNL3fn2pCrllkUz6pwN75yTJUlTdKcrKJU3mLY8:RslLVF6DXjCGBf0CrllFm+N7CCscrjkp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1752	2032	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1752	2032	2c62ee8a2a75daa0e436c91a1a479155.exe	28
PID 2032 wrote to memory of 1752	2032	2c62ee8a2a75daa0e436c91a1a479155.exe	28
PID 2032 wrote to memory of 1752	2032	2c62ee8a2a75daa0e436c91a1a479155.exe	28
PID 2032 wrote to memory of 1752	2032	2c62ee8a2a75daa0e436c91a1a479155.exe	28

C:\Users\Admin\AppData\Local\Temp\2c62ee8a2a75daa0e436c91a1a479155.exe
"C:\Users\Admin\AppData\Local\Temp\2c62ee8a2a75daa0e436c91a1a479155.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 88
  2⤵
  - Program crash
  PID:1752

memory/2032-1-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download
memory/2032-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download