ca854cbf1636353ed5e6d785171c2b4634efe5bd9af0e4f96e1cccbb041276ec

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19-01-2024 14:30

Target

67db9d2b66526d5342907ddf8136af0b.exe
Size

84KB
MD5

67db9d2b66526d5342907ddf8136af0b
SHA1

bb0a637c41e3a152ffc1a0e2c34117625c9fe282
SHA256

ca854cbf1636353ed5e6d785171c2b4634efe5bd9af0e4f96e1cccbb041276ec
SHA512

130e1b349c69324855f5709db4dc60140caad935bf76d60ff05d049c93413f1a91932cbc77c73ba7af16a69db9ee19f42bdf2a6fd066afd8793b8d46ee92015f
SSDEEP

1536:5fJEhkWeQnXR1pYsx3P5FHWgUYkvcxTgbZLijn/xsDF7qFwrWvC9m1YVLL8VylR:5xEhkmXbpJ3BF2gB5sDpqLbyL8glR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3000	2548	WerFault.exe	11

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 3000	2548	67db9d2b66526d5342907ddf8136af0b.exe	28
PID 2548 wrote to memory of 3000	2548	67db9d2b66526d5342907ddf8136af0b.exe	28
PID 2548 wrote to memory of 3000	2548	67db9d2b66526d5342907ddf8136af0b.exe	28
PID 2548 wrote to memory of 3000	2548	67db9d2b66526d5342907ddf8136af0b.exe	28

C:\Users\Admin\AppData\Local\Temp\67db9d2b66526d5342907ddf8136af0b.exe
"C:\Users\Admin\AppData\Local\Temp\67db9d2b66526d5342907ddf8136af0b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 88
  2⤵
  - Program crash
  PID:3000

memory/2548-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2548-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2548-2-0x00000000001B0000-0x00000000001B6000-memory.dmp

Filesize
24KB

Download
memory/2548-3-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download