14ae5fb1b00525a6035f46ddb9ab6698a7f83d60bf2436e48983fdd4ea0234d0

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 12:01

Target

56681ada29622d9038ce4672424d98c7.exe
Size

293KB
MD5

56681ada29622d9038ce4672424d98c7
SHA1

c0573ba87af065ec42ded136c1621a9bb54ca4b5
SHA256

14ae5fb1b00525a6035f46ddb9ab6698a7f83d60bf2436e48983fdd4ea0234d0
SHA512

8689649178c0bafdadf8414bc49f852d7d7b046c0fc9c3938fa9e7f6374a3c54b2d90150e46249a1d8136f0580a1d72834e97280bb5dc6f3f0492abed6371fce
SSDEEP

6144:ePdMXMANEVzGlcEDUl4qaRYVQcJTGbusJRhgnGXccD7Xm2BeddhMHeEYHl:BNEh8cSLqdnsisDhgnGHBBedDMJYF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2372	2428	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2372	2428	56681ada29622d9038ce4672424d98c7.exe	28
PID 2428 wrote to memory of 2372	2428	56681ada29622d9038ce4672424d98c7.exe	28
PID 2428 wrote to memory of 2372	2428	56681ada29622d9038ce4672424d98c7.exe	28
PID 2428 wrote to memory of 2372	2428	56681ada29622d9038ce4672424d98c7.exe	28

C:\Users\Admin\AppData\Local\Temp\56681ada29622d9038ce4672424d98c7.exe
"C:\Users\Admin\AppData\Local\Temp\56681ada29622d9038ce4672424d98c7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 140
  2⤵
  - Program crash
  PID:2372

memory/2428-0-0x0000000000270000-0x00000000002B1000-memory.dmp

Filesize
260KB

Download
memory/2428-1-0x00000000002C0000-0x000000000030B000-memory.dmp

Filesize
300KB

Download
memory/2428-2-0x0000000000270000-0x00000000002B1000-memory.dmp

Filesize
260KB

Download