3d34909d31daee744f5c0ed45c48ac610e073fce086d9b50e0c8db52f52bf14d

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 04:31

Target

66b465021d1cfcad1247a37d2f059d1e.exe
Size

32KB
MD5

66b465021d1cfcad1247a37d2f059d1e
SHA1

b408df8bbc8e8ea2b2d2392e3727392e1e791be0
SHA256

3d34909d31daee744f5c0ed45c48ac610e073fce086d9b50e0c8db52f52bf14d
SHA512

209a1db4f22749ae2268da136dd9c676e31a0b829f08d6f033f8cae0f8b06a5ed26035a0bf1b728b00b94a9532b2787103bfddc6949cfd97ec80c97f0284e2b0
SSDEEP

192:okSl0bLmZ1j5OvPlVZFREHpePNpx+gGbuPgIFazGFzzl:okmWqnj5OFRyoPbxNguDJF9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3064	2648	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 3064	2648	66b465021d1cfcad1247a37d2f059d1e.exe	28
PID 2648 wrote to memory of 3064	2648	66b465021d1cfcad1247a37d2f059d1e.exe	28
PID 2648 wrote to memory of 3064	2648	66b465021d1cfcad1247a37d2f059d1e.exe	28
PID 2648 wrote to memory of 3064	2648	66b465021d1cfcad1247a37d2f059d1e.exe	28

C:\Users\Admin\AppData\Local\Temp\66b465021d1cfcad1247a37d2f059d1e.exe
"C:\Users\Admin\AppData\Local\Temp\66b465021d1cfcad1247a37d2f059d1e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 88
  2⤵
  - Program crash
  PID:3064

memory/2648-0-0x0000000009100000-0x000000000910B000-memory.dmp

Filesize
44KB

Download
memory/2648-1-0x0000000076BF0000-0x0000000076C37000-memory.dmp

Filesize
284KB

Download