1aefc2423d053fc03a0da1a09204f255a9550706ab65c5718bb4d040289be3e5

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 08:09

Target

89005a881f694ebbdc072ee74c328801.exe
Size

24KB
MD5

89005a881f694ebbdc072ee74c328801
SHA1

48167d8110588a1827e13f55257eb32b0bc7ed18
SHA256

1aefc2423d053fc03a0da1a09204f255a9550706ab65c5718bb4d040289be3e5
SHA512

76f47e099b96807ce1f322cf7a62fd99d465019a625d9d6d4b43001acccd9acb3e06414860982dd13e40dbbb8930e3b2e2c4c2ab7d62427f769296a20b46305b
SSDEEP

384:yEI2c2F6UupEzoXFbhHbWb5dkLQTngSfesVvLubiMYi9+B0ESbi16/JR7NgjsW6/:yb2cm6ZprXzKZzVevn+mHR7NIJA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2932	1032	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 2932	1032	89005a881f694ebbdc072ee74c328801.exe	28
PID 1032 wrote to memory of 2932	1032	89005a881f694ebbdc072ee74c328801.exe	28
PID 1032 wrote to memory of 2932	1032	89005a881f694ebbdc072ee74c328801.exe	28
PID 1032 wrote to memory of 2932	1032	89005a881f694ebbdc072ee74c328801.exe	28

C:\Users\Admin\AppData\Local\Temp\89005a881f694ebbdc072ee74c328801.exe
"C:\Users\Admin\AppData\Local\Temp\89005a881f694ebbdc072ee74c328801.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 36
  2⤵
  - Program crash
  PID:2932

memory/1032-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download