2af781fa7b97f2d1ac6967ba649cc5d0eff845801fc67afd862a0f7ea66dd05a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 01:51

Target

656e5c9ac30adcc73fd328d3a06666a4.exe
Size

166KB
MD5

656e5c9ac30adcc73fd328d3a06666a4
SHA1

e00c5d55b017961807ee9b08de15210037d68b7c
SHA256

2af781fa7b97f2d1ac6967ba649cc5d0eff845801fc67afd862a0f7ea66dd05a
SHA512

7126698ef7100f5cdd1037cff48fd94b680684294195556f51a83a4bc099784760a243380becebccaf341dbd3ce2c9874cb69520adc402b99d118792be4fc029
SSDEEP

3072:Cd3dDgvOfewLhEUm2vihchNLpW/NHNHN3Nj:SND2XR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1080	2436	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1080	2436	656e5c9ac30adcc73fd328d3a06666a4.exe	28
PID 2436 wrote to memory of 1080	2436	656e5c9ac30adcc73fd328d3a06666a4.exe	28
PID 2436 wrote to memory of 1080	2436	656e5c9ac30adcc73fd328d3a06666a4.exe	28
PID 2436 wrote to memory of 1080	2436	656e5c9ac30adcc73fd328d3a06666a4.exe	28

C:\Users\Admin\AppData\Local\Temp\656e5c9ac30adcc73fd328d3a06666a4.exe
"C:\Users\Admin\AppData\Local\Temp\656e5c9ac30adcc73fd328d3a06666a4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 684
  2⤵
  - Program crash
  PID:1080

memory/2436-0-0x0000000000DD0000-0x0000000000E00000-memory.dmp

Filesize
192KB

Download
memory/2436-1-0x0000000074530000-0x0000000074C1E000-memory.dmp

Filesize
6.9MB

Download
memory/2436-2-0x0000000000640000-0x0000000000680000-memory.dmp

Filesize
256KB

Download
memory/2436-3-0x0000000074530000-0x0000000074C1E000-memory.dmp

Filesize
6.9MB

Download
memory/2436-4-0x0000000000640000-0x0000000000680000-memory.dmp

Filesize
256KB

Download