0669dcf489c7818cd55acee832fc203320c26b01c00cf86b6f988f172401f999

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 23:30

Target

78ad4dbfc0a4f8c06fc28024a9999327.exe
Size

104KB
MD5

78ad4dbfc0a4f8c06fc28024a9999327
SHA1

8513c94405cd0e332f39da881eaa43e42ed5d3e7
SHA256

0669dcf489c7818cd55acee832fc203320c26b01c00cf86b6f988f172401f999
SHA512

e0ad9fab2cdd64819068be2a471c66e6116258b93d9458732cabb89969a6e9ef65e41152592e8002a0abc51cc8619bd1a4f0f90347024f3c4cab5470ba9ab2dc
SSDEEP

3072:IkPeeCb8UXGSTccT3Waq1v40coSm+iHBa7N3xU:IkWeDUXG23iv40coSVoBa7N3W

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2884	2536	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2884	2536	78ad4dbfc0a4f8c06fc28024a9999327.exe	28
PID 2536 wrote to memory of 2884	2536	78ad4dbfc0a4f8c06fc28024a9999327.exe	28
PID 2536 wrote to memory of 2884	2536	78ad4dbfc0a4f8c06fc28024a9999327.exe	28
PID 2536 wrote to memory of 2884	2536	78ad4dbfc0a4f8c06fc28024a9999327.exe	28

C:\Users\Admin\AppData\Local\Temp\78ad4dbfc0a4f8c06fc28024a9999327.exe
"C:\Users\Admin\AppData\Local\Temp\78ad4dbfc0a4f8c06fc28024a9999327.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 36
  2⤵
  - Program crash
  PID:2884

memory/2536-0-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2536-1-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download