d41a28354c650c484806f56078a73fe11120a425c4a8f5c6a12cb4542e6f4c31

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 05:27

Target

88acd034ae9693401015ba858749add0.exe
Size

127KB
MD5

88acd034ae9693401015ba858749add0
SHA1

8595d209e8aa50ec8b9bf54423cc568d56a70fe1
SHA256

d41a28354c650c484806f56078a73fe11120a425c4a8f5c6a12cb4542e6f4c31
SHA512

61a3fc70445450c74186fe3aa0c1b8969983934cb2721f707ee9d4887332049152bfbbb6d632b5312c380ee90447d81760f1740b6cfa32d79a7183062ac2e78b
SSDEEP

3072:+irC6/NzyTMLxHeZmSRTScTDax+ZvG+OIpiL/2sZCfiDcNMLxa:BrN/h0Zn0c3tQ+VpiqsTlc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1076	2964	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 1076	2964	88acd034ae9693401015ba858749add0.exe	28
PID 2964 wrote to memory of 1076	2964	88acd034ae9693401015ba858749add0.exe	28
PID 2964 wrote to memory of 1076	2964	88acd034ae9693401015ba858749add0.exe	28
PID 2964 wrote to memory of 1076	2964	88acd034ae9693401015ba858749add0.exe	28

C:\Users\Admin\AppData\Local\Temp\88acd034ae9693401015ba858749add0.exe
"C:\Users\Admin\AppData\Local\Temp\88acd034ae9693401015ba858749add0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 36
  2⤵
  - Program crash
  PID:1076

memory/2964-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2964-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download