2aade20dce5b9cefa727322ab2029ad0c7105a7c2d866d3d108344962002b2e4

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 09:33

Target

71dfac62b95a6849ffb0a26ff86d9020.exe
Size

32KB
MD5

71dfac62b95a6849ffb0a26ff86d9020
SHA1

5f575796d6b90360289ad55fe8ea9d60f3c3b0ee
SHA256

2aade20dce5b9cefa727322ab2029ad0c7105a7c2d866d3d108344962002b2e4
SHA512

42c8bd0bee6abe2e77114af34eb3031495dd0478961b472324969acb8918f8e6a3912341083f62f72fe3ef5098585de7ff0c64cebe2fedcd83f2dabc93fe9e0f
SSDEEP

384:gMj4fzgxvPqTOFirFqTabCMUxDk2ieB7Hq7ZtkD4m4wRvAeA3NHH2hS4wkk0K0MG:6yyTWFTyCMkk+D4rwRvfWtWcbkPKi/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1028	3040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 1028	3040	71dfac62b95a6849ffb0a26ff86d9020.exe	28
PID 3040 wrote to memory of 1028	3040	71dfac62b95a6849ffb0a26ff86d9020.exe	28
PID 3040 wrote to memory of 1028	3040	71dfac62b95a6849ffb0a26ff86d9020.exe	28
PID 3040 wrote to memory of 1028	3040	71dfac62b95a6849ffb0a26ff86d9020.exe	28

C:\Users\Admin\AppData\Local\Temp\71dfac62b95a6849ffb0a26ff86d9020.exe
"C:\Users\Admin\AppData\Local\Temp\71dfac62b95a6849ffb0a26ff86d9020.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 36
  2⤵
  - Program crash
  PID:1028

memory/3040-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download