3f1c6b2e6f6a96b7d9d83d2e043c5ec4bfa632f181f396fb4a5bdf04266ff884

Analysis

max time kernel
142s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18-01-2024 18:56

Target

65c9171c59824abf19683aad27acca23.exe
Size

79KB
MD5

65c9171c59824abf19683aad27acca23
SHA1

57dada2259d13dc4047bb296ac1552c2c956689e
SHA256

3f1c6b2e6f6a96b7d9d83d2e043c5ec4bfa632f181f396fb4a5bdf04266ff884
SHA512

682d8cf4ee051b027ffcb9754166f544707ca5d8ba37b7b2bd3bc2aa26b95a1ec6998b25600aa7821988da7a587b04dbe575ad125ddd93af3c2620401be92d42
SSDEEP

1536:emGfxYz8xTVffO1Xp30VXE9O53lVZL3tvpS+fs7u1NN/v8Jrw8FkWl:eTpxTVu1Xpk483lHL3tvs+0yLv81Dl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2060	2044	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2060	2044	65c9171c59824abf19683aad27acca23.exe	28
PID 2044 wrote to memory of 2060	2044	65c9171c59824abf19683aad27acca23.exe	28
PID 2044 wrote to memory of 2060	2044	65c9171c59824abf19683aad27acca23.exe	28
PID 2044 wrote to memory of 2060	2044	65c9171c59824abf19683aad27acca23.exe	28

C:\Users\Admin\AppData\Local\Temp\65c9171c59824abf19683aad27acca23.exe
"C:\Users\Admin\AppData\Local\Temp\65c9171c59824abf19683aad27acca23.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 36
  2⤵
  - Program crash
  PID:2060

memory/2044-0-0x0000000013140000-0x0000000013173000-memory.dmp

Filesize
204KB

Download