47898c0cf4bf8add2024fbcb2f4084bc99fa8b7b8fc557b84209aa66408b9b21

Analysis

max time kernel
142s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 20:24

Target

688e9bbd147a3da8ef3ccbfb6344f588.exe
Size

115KB
MD5

688e9bbd147a3da8ef3ccbfb6344f588
SHA1

26bba9accff0632a9fa687b18ff360230b723589
SHA256

47898c0cf4bf8add2024fbcb2f4084bc99fa8b7b8fc557b84209aa66408b9b21
SHA512

854bda25bff58b71388617c5d7500d117cb0f31b429a03326a401c815373aac793a68753f677c7fe8bb9c97e025f77ba51dadef9d0583b0d16ae0b5275f01d7d
SSDEEP

1536:1N13fCJQDNK/PBkTrkgc5fh/tQ/32NLYn0EYdWFeLW65UT9BeK/tb6CLOI8RmUhP:n1amD3TrgpVQ30EYddpE9o616CLkmts

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1968	1948	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1948	688e9bbd147a3da8ef3ccbfb6344f588.exe
1948	688e9bbd147a3da8ef3ccbfb6344f588.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1948	688e9bbd147a3da8ef3ccbfb6344f588.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1968	1948	688e9bbd147a3da8ef3ccbfb6344f588.exe	28
PID 1948 wrote to memory of 1968	1948	688e9bbd147a3da8ef3ccbfb6344f588.exe	28
PID 1948 wrote to memory of 1968	1948	688e9bbd147a3da8ef3ccbfb6344f588.exe	28
PID 1948 wrote to memory of 1968	1948	688e9bbd147a3da8ef3ccbfb6344f588.exe	28

C:\Users\Admin\AppData\Local\Temp\688e9bbd147a3da8ef3ccbfb6344f588.exe
"C:\Users\Admin\AppData\Local\Temp\688e9bbd147a3da8ef3ccbfb6344f588.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 416
  2⤵
  - Program crash
  PID:1968

memory/1948-0-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download