897a25c05cecaf48cb0b64644a7a9395a6e1d4419e56645a030c8f31af56f284

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 17:38

Target

877c26d020fad709dba0f301f87b8955.exe
Size

76KB
MD5

877c26d020fad709dba0f301f87b8955
SHA1

9fe2f6d789ab5da2fc002fc25802d4fba1fca0b6
SHA256

897a25c05cecaf48cb0b64644a7a9395a6e1d4419e56645a030c8f31af56f284
SHA512

93cadb6b34a0287a10a416589aa1c32ef0328fcc00e0228479690b3a544a0570ca32a980b4d1187c57d3b35999a60c77a0762de855ff49dfd392f8b78ed05f13
SSDEEP

1536:5xCTVAiOvwmiOz0dtIqWOxB78xxiiIPRjCYpjVrs2ryrd1vUQuq6:rRiiwmLzaOqlp8WiI52YHs2qo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2468	1968	WerFault.exe	6

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2468	1968	877c26d020fad709dba0f301f87b8955.exe	27
PID 1968 wrote to memory of 2468	1968	877c26d020fad709dba0f301f87b8955.exe	27
PID 1968 wrote to memory of 2468	1968	877c26d020fad709dba0f301f87b8955.exe	27
PID 1968 wrote to memory of 2468	1968	877c26d020fad709dba0f301f87b8955.exe	27

C:\Users\Admin\AppData\Local\Temp\877c26d020fad709dba0f301f87b8955.exe
"C:\Users\Admin\AppData\Local\Temp\877c26d020fad709dba0f301f87b8955.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 36
  2⤵
  - Program crash
  PID:2468

memory/1968-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download