6e0ec15384a252d7f3d5b2ca3d161b74d15f8b1deb140d0bf2d7a6b0bd5a9375

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-02-2024 03:51

Target

887a5ad8ef82c0b05a9f1246a30d72cf.exe
Size

58KB
MD5

887a5ad8ef82c0b05a9f1246a30d72cf
SHA1

aae39814505f38c25a377d6133ccfbbe75218d31
SHA256

6e0ec15384a252d7f3d5b2ca3d161b74d15f8b1deb140d0bf2d7a6b0bd5a9375
SHA512

21cca28846c662ea908f7ae12366596535500d8add9f50395adc6393f32f89db3cd067dfafdf11b844cdc77042130b61fb7b7cd12d0f7e4759e0e1072f123258
SSDEEP

1536:OwssZ+NLjq/IRrDpZX3TGkZ2lfz5OXcQokRna:OwssZ+xjq/IRrvTGkIVOX7o8na

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
532	2116	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 532	2116	887a5ad8ef82c0b05a9f1246a30d72cf.exe	28
PID 2116 wrote to memory of 532	2116	887a5ad8ef82c0b05a9f1246a30d72cf.exe	28
PID 2116 wrote to memory of 532	2116	887a5ad8ef82c0b05a9f1246a30d72cf.exe	28
PID 2116 wrote to memory of 532	2116	887a5ad8ef82c0b05a9f1246a30d72cf.exe	28

C:\Users\Admin\AppData\Local\Temp\887a5ad8ef82c0b05a9f1246a30d72cf.exe
"C:\Users\Admin\AppData\Local\Temp\887a5ad8ef82c0b05a9f1246a30d72cf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 36
  2⤵
  - Program crash
  PID:532

memory/2116-0-0x0000000000400000-0x000000000040991F-memory.dmp

Filesize
38KB

Download
memory/2116-1-0x0000000000400000-0x000000000040991F-memory.dmp

Filesize
38KB

Download