87e60190f2416cc8d9a7fe94b22e8bb361db2a0dc851280890307943ffccec21

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 06:29

Target

66ee7af30b7ceca514a6fc5acb137d27.exe
Size

79KB
MD5

66ee7af30b7ceca514a6fc5acb137d27
SHA1

30a02f48b22eb9d0c4517e7dcffcc364145942c6
SHA256

87e60190f2416cc8d9a7fe94b22e8bb361db2a0dc851280890307943ffccec21
SHA512

bd17d156d816126e12007fedc7a023eb9e5565beb1d84038a97d4d379d8c6fca723081643a4c8cd10bccf4d378e0d3926d20f494c6d1d81004bdc7db712add43
SSDEEP

1536:vo15MzLpvuwjavf5UpLQCRvsmV3ofOmYAmRI5X2mCLGv2ne:A15MzlDa3lCR6xmRp1KMe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2092	2460	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2092	2460	66ee7af30b7ceca514a6fc5acb137d27.exe	28
PID 2460 wrote to memory of 2092	2460	66ee7af30b7ceca514a6fc5acb137d27.exe	28
PID 2460 wrote to memory of 2092	2460	66ee7af30b7ceca514a6fc5acb137d27.exe	28
PID 2460 wrote to memory of 2092	2460	66ee7af30b7ceca514a6fc5acb137d27.exe	28

C:\Users\Admin\AppData\Local\Temp\66ee7af30b7ceca514a6fc5acb137d27.exe
"C:\Users\Admin\AppData\Local\Temp\66ee7af30b7ceca514a6fc5acb137d27.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 88
  2⤵
  - Program crash
  PID:2092

memory/2460-0-0x0000000044440000-0x0000000044457000-memory.dmp

Filesize
92KB

Download