a1b37d7a8f2815b12ce4caadd0c4816965be7f08b5a40cd9030600874e16ca50

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 14:03

Target

390daf220f11da6de39f53356ad85766.exe
Size

422KB
MD5

390daf220f11da6de39f53356ad85766
SHA1

7ca0d651b2f02b6c32be2b9239752f125bf66c13
SHA256

a1b37d7a8f2815b12ce4caadd0c4816965be7f08b5a40cd9030600874e16ca50
SHA512

a8b0b6708aaeb1191d083374f73b3bfa6829072bf6c1873c2dc67fe992dbcbad5bdd32f558e676424b52b4dcade9b1e387269ab319c65125929098d8086fd81d
SSDEEP

6144:ykB1INZdWaFzaE7mDGg7Y4+MFyBPys80G5sEOi9Ri9na5UVx3:ykBgdW/E7mDGg8xMkBp80GiZa5UVh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2156	2680	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2156	2680	390daf220f11da6de39f53356ad85766.exe	27
PID 2680 wrote to memory of 2156	2680	390daf220f11da6de39f53356ad85766.exe	27
PID 2680 wrote to memory of 2156	2680	390daf220f11da6de39f53356ad85766.exe	27
PID 2680 wrote to memory of 2156	2680	390daf220f11da6de39f53356ad85766.exe	27

C:\Users\Admin\AppData\Local\Temp\390daf220f11da6de39f53356ad85766.exe
"C:\Users\Admin\AppData\Local\Temp\390daf220f11da6de39f53356ad85766.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 116
  2⤵
  - Program crash
  PID:2156

memory/2680-0-0x0000000001370000-0x00000000013DE000-memory.dmp

Filesize
440KB

Download