0ae9f23b7758f5624d8367910e95d8f49cde463b47628920cc461e73311e55a3

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 02:36

Target

3bab996a2ca6ecb165c66954855ad025.exe
Size

61KB
MD5

3bab996a2ca6ecb165c66954855ad025
SHA1

44a2dd104bbb89a92df675e44b6a4ee8a614c705
SHA256

0ae9f23b7758f5624d8367910e95d8f49cde463b47628920cc461e73311e55a3
SHA512

b8ae58585b37d0ceb98ea3ef42b5076e7b298aef762027247f7f603197886890773ba5f07bc6cd97353ed7fcab874cb1501116d5ed6b4a151bbbdc09eb840541
SSDEEP

1536:4WrJpTed8eBQHo7LBo0r0eYcKkJycIXWAbZpmlkHkwMA4ZjNKoypR:h9p4BQHohoO0eY7GIXZ1IC0IpR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2292	2840	WerFault.exe	10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2292	2840	3bab996a2ca6ecb165c66954855ad025.exe	28
PID 2840 wrote to memory of 2292	2840	3bab996a2ca6ecb165c66954855ad025.exe	28
PID 2840 wrote to memory of 2292	2840	3bab996a2ca6ecb165c66954855ad025.exe	28
PID 2840 wrote to memory of 2292	2840	3bab996a2ca6ecb165c66954855ad025.exe	28

C:\Users\Admin\AppData\Local\Temp\3bab996a2ca6ecb165c66954855ad025.exe
"C:\Users\Admin\AppData\Local\Temp\3bab996a2ca6ecb165c66954855ad025.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 88
  2⤵
  - Program crash
  PID:2292

memory/2840-0-0x0000000000400000-0x0000000000411F46-memory.dmp

Filesize
71KB

Download
memory/2840-1-0x0000000000220000-0x000000000022E000-memory.dmp

Filesize
56KB

Download