13d6b68b492666ff031247eb3643f299c530455b5547e31b5d4525ede113038d

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 15:42

Target

89e77fbc40fbec8634e14735b73e1e8b.exe
Size

83KB
MD5

89e77fbc40fbec8634e14735b73e1e8b
SHA1

833244644c24a547a9ffbd97f03f95d55596545d
SHA256

13d6b68b492666ff031247eb3643f299c530455b5547e31b5d4525ede113038d
SHA512

75d000ef3f07872e7953617f1951a92e0436291a4521581518b7538be2465b582dc530ae8c28c059d864495aacaab462f8ef46a72d6ca1c89c3493d0b57fa120
SSDEEP

1536:hy+53F5HIbVSo2Zm7c660mowS/Ia20GCwkeX7OvHLDUujVT:4+5V5oYo2E7h6bBSQaLwkeXSPbVT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2308	1656	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2308	1656	89e77fbc40fbec8634e14735b73e1e8b.exe	28
PID 1656 wrote to memory of 2308	1656	89e77fbc40fbec8634e14735b73e1e8b.exe	28
PID 1656 wrote to memory of 2308	1656	89e77fbc40fbec8634e14735b73e1e8b.exe	28
PID 1656 wrote to memory of 2308	1656	89e77fbc40fbec8634e14735b73e1e8b.exe	28

C:\Users\Admin\AppData\Local\Temp\89e77fbc40fbec8634e14735b73e1e8b.exe
"C:\Users\Admin\AppData\Local\Temp\89e77fbc40fbec8634e14735b73e1e8b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 36
  2⤵
  - Program crash
  PID:2308

memory/1656-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1656-1-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download