d81b465d243df9d092090e008a471f04699c4a0ddf2016c360c48b146b9100e2

Analysis

max time kernel
140s
max time network
117s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 21:44

Target

661b8e56160542d98bb3f9c01c2c39b0.exe
Size

38KB
MD5

661b8e56160542d98bb3f9c01c2c39b0
SHA1

402e981b10983b2ef84696bdcf32caa01640b569
SHA256

d81b465d243df9d092090e008a471f04699c4a0ddf2016c360c48b146b9100e2
SHA512

d3170a7e5a7062b7daf4f3bb074b5418d5af53bbbc5707264919f1aca1b6a7ce38a379380ae6b4da019ef074b7b1155a31c03b6e1978cf5497a21f06e49343bb
SSDEEP

768:GKtAQ50+1hug3f5pQ+vYKsqXz9k0aqPEA6rFZroDNZ491pA7x4:VtZhukxpQ+gKs2zKHA6pA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1632	2288	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 1632	2288	661b8e56160542d98bb3f9c01c2c39b0.exe	28
PID 2288 wrote to memory of 1632	2288	661b8e56160542d98bb3f9c01c2c39b0.exe	28
PID 2288 wrote to memory of 1632	2288	661b8e56160542d98bb3f9c01c2c39b0.exe	28
PID 2288 wrote to memory of 1632	2288	661b8e56160542d98bb3f9c01c2c39b0.exe	28

C:\Users\Admin\AppData\Local\Temp\661b8e56160542d98bb3f9c01c2c39b0.exe
"C:\Users\Admin\AppData\Local\Temp\661b8e56160542d98bb3f9c01c2c39b0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 136
  2⤵
  - Program crash
  PID:1632

memory/2288-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2288-1-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download