cd88e6127ef86d8cf1c21c8c2d35cfbee3d4634417ecfce2e46810997f50a2d2

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 07:00

Target

863d14d96f14fe9483938440a9719b6a.exe
Size

28KB
MD5

863d14d96f14fe9483938440a9719b6a
SHA1

bb5004dfecfc2e804f3b131f55f48171294e7f2e
SHA256

cd88e6127ef86d8cf1c21c8c2d35cfbee3d4634417ecfce2e46810997f50a2d2
SHA512

de49f770264fa2593f1bd86a31887c43cd54c655961c53ccded3689c19f53cca003f99f0c848031f31d797def0cae8b8b2c19f2d3ca5d180f07f81a1082fc961
SSDEEP

384:froJMim0OWAcfAglOF1tTKuQKGt3F9AMdbf7073PphjK0EH0pRyE2ezgBtsP4KJH:fkA2flYR/+3o0H073PHjvEH7PCg24GH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2004	1992	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2004	1992	863d14d96f14fe9483938440a9719b6a.exe	28
PID 1992 wrote to memory of 2004	1992	863d14d96f14fe9483938440a9719b6a.exe	28
PID 1992 wrote to memory of 2004	1992	863d14d96f14fe9483938440a9719b6a.exe	28
PID 1992 wrote to memory of 2004	1992	863d14d96f14fe9483938440a9719b6a.exe	28

C:\Users\Admin\AppData\Local\Temp\863d14d96f14fe9483938440a9719b6a.exe
"C:\Users\Admin\AppData\Local\Temp\863d14d96f14fe9483938440a9719b6a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 36
  2⤵
  - Program crash
  PID:2004

memory/1992-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download