94e05a922b50bfdf092735fe833d1020de2a0a56facbc9127a80b002c897ad17

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 13:23

Target

67b950233a0f164939597b55a8223d7f.exe
Size

239KB
MD5

67b950233a0f164939597b55a8223d7f
SHA1

89ac06ef11e09665c88cc94d60439b5d60d8bca4
SHA256

94e05a922b50bfdf092735fe833d1020de2a0a56facbc9127a80b002c897ad17
SHA512

903092b789196837c45027c5d5de47e4c87407e01c341088aeadb35b7e9348e7cb50dda0c9df02757e19bb04ffa23326361209ad5639751e675fc3e1d531a932
SSDEEP

6144:mStQYM3YATdMKYS1YbA80DeDgtcfI8UDNPBecwDU8vC/1pU:TOYMIGaKTzReDgtwiNPBe5+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2244	2640	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2244	2640	67b950233a0f164939597b55a8223d7f.exe	28
PID 2640 wrote to memory of 2244	2640	67b950233a0f164939597b55a8223d7f.exe	28
PID 2640 wrote to memory of 2244	2640	67b950233a0f164939597b55a8223d7f.exe	28
PID 2640 wrote to memory of 2244	2640	67b950233a0f164939597b55a8223d7f.exe	28

C:\Users\Admin\AppData\Local\Temp\67b950233a0f164939597b55a8223d7f.exe
"C:\Users\Admin\AppData\Local\Temp\67b950233a0f164939597b55a8223d7f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 36
  2⤵
  - Program crash
  PID:2244

memory/2640-0-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download