61f7de94de78e5f56bac7dc2ff6719fe7786d8acbbf5215aa18729f24a8cd0db

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 19:55

Target

097ffcef08922f90e664c366679133aa.exe
Size

63KB
MD5

097ffcef08922f90e664c366679133aa
SHA1

3eba442bb42fe25153b96c5d1d91dc4bf23f89f3
SHA256

61f7de94de78e5f56bac7dc2ff6719fe7786d8acbbf5215aa18729f24a8cd0db
SHA512

3efc22eb8e3369e9676ad7f41e2e4d4b049fbf8557824d209a59d2e68b8c8a2a2b3d18a51b6f45f2f503dc2186345c71cda8efb304a131f5a1b909bd37a8c9aa
SSDEEP

1536:pY8KpQL5eYFGp+kOj+GyjBazkaskwkzLdtuFIoGBaXYEKG:EpQL5etrOyGaBazFsiz+NGBquG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3052	1044	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 3052	1044	097ffcef08922f90e664c366679133aa.exe	28
PID 1044 wrote to memory of 3052	1044	097ffcef08922f90e664c366679133aa.exe	28
PID 1044 wrote to memory of 3052	1044	097ffcef08922f90e664c366679133aa.exe	28
PID 1044 wrote to memory of 3052	1044	097ffcef08922f90e664c366679133aa.exe	28

C:\Users\Admin\AppData\Local\Temp\097ffcef08922f90e664c366679133aa.exe
"C:\Users\Admin\AppData\Local\Temp\097ffcef08922f90e664c366679133aa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 96
  2⤵
  - Program crash
  PID:3052

memory/1044-0-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download
memory/1044-1-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download