b732825345bf2786ec03c8d5cea4d116a1c9deb8168f2c4f3ee63c929bfaa25c

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18-01-2024 07:38

Target

64d78350223857809dbb090ac970bd0f.exe
Size

12KB
MD5

64d78350223857809dbb090ac970bd0f
SHA1

678dc0209db1479e3bfe1443e7ae8c3c00d1cbe4
SHA256

b732825345bf2786ec03c8d5cea4d116a1c9deb8168f2c4f3ee63c929bfaa25c
SHA512

60c637f2fc974e92b9d1921929b780de9e983528c7b48e2499514ed7e0698b0da8b8e3a40c5521d3d55492e7373b3cb87c267b59bd444d6535afd3df1a0a57f0
SSDEEP

192:rcGc1Zl2+VAfNxl1THs6xgzgVGjPlRdqL766nQAlKhFo22Xs6Z0oWz:wGcMJxDTHfRm8Hc6tWz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2204	3048	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2204	3048	64d78350223857809dbb090ac970bd0f.exe	28
PID 3048 wrote to memory of 2204	3048	64d78350223857809dbb090ac970bd0f.exe	28
PID 3048 wrote to memory of 2204	3048	64d78350223857809dbb090ac970bd0f.exe	28
PID 3048 wrote to memory of 2204	3048	64d78350223857809dbb090ac970bd0f.exe	28

C:\Users\Admin\AppData\Local\Temp\64d78350223857809dbb090ac970bd0f.exe
"C:\Users\Admin\AppData\Local\Temp\64d78350223857809dbb090ac970bd0f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 36
  2⤵
  - Program crash
  PID:2204

memory/3048-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download