d122c881f4d6b58dc8cb1029c827e4b33390dd2eaacc56f294b29c1a87e82001

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 00:16

Target

733c73cce49460b0975a3cbd1a7f2a73.exe
Size

208KB
MD5

733c73cce49460b0975a3cbd1a7f2a73
SHA1

b4b09fa7cfcb123bcd82ce78495be24d77c721ea
SHA256

d122c881f4d6b58dc8cb1029c827e4b33390dd2eaacc56f294b29c1a87e82001
SHA512

d47f3d21f29559588866aec7e6565cf3dcce3e692c2e25be2e6c6349d24af47a3121a9727b17785a037aabb13095e931f78438cbbd592fc87a7f9cab25a6b5ad
SSDEEP

1536:HVQNIgCcnihxGltbwYLU9KD02BBA2KmaPoYkwAyd:HVHgCc4xGvbwcU9KQ2BBAHmaPxB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2872	2992	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2872	2992	733c73cce49460b0975a3cbd1a7f2a73.exe	16
PID 2992 wrote to memory of 2872	2992	733c73cce49460b0975a3cbd1a7f2a73.exe	16
PID 2992 wrote to memory of 2872	2992	733c73cce49460b0975a3cbd1a7f2a73.exe	16
PID 2992 wrote to memory of 2872	2992	733c73cce49460b0975a3cbd1a7f2a73.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 36
1⤵
- Program crash
PID:2872

C:\Users\Admin\AppData\Local\Temp\733c73cce49460b0975a3cbd1a7f2a73.exe
"C:\Users\Admin\AppData\Local\Temp\733c73cce49460b0975a3cbd1a7f2a73.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2992

memory/2992-0-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download