89a66b22c8eece79a0717e64c9400d26e352f5685d9c451a36b0f9af691250b9

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 23:14

Target

97ddeb89894ee7f8eb10be0510503a56.exe
Size

104KB
MD5

97ddeb89894ee7f8eb10be0510503a56
SHA1

bf7f0c3248a0262a88abef6fc60a629eae8c8da4
SHA256

89a66b22c8eece79a0717e64c9400d26e352f5685d9c451a36b0f9af691250b9
SHA512

33a1b1ae7adab4b3974f49919356201e7ac0fdfd0eb7dfa4b2882d335448c5d942255913384039c74cf6548bb539a0b61ada23b73405b4165dd0511a4bd12c22
SSDEEP

1536:RqALm7pFLFHMlnMhPvwQBl9ksKamvTA3hFvt05qgWethg6HtSXj4jqipLPhfRs1j:oBZC4PvlBQsyvTARPFgpiA1jqARRzNY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2184	3056	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2184	3056	97ddeb89894ee7f8eb10be0510503a56.exe	28
PID 3056 wrote to memory of 2184	3056	97ddeb89894ee7f8eb10be0510503a56.exe	28
PID 3056 wrote to memory of 2184	3056	97ddeb89894ee7f8eb10be0510503a56.exe	28
PID 3056 wrote to memory of 2184	3056	97ddeb89894ee7f8eb10be0510503a56.exe	28

C:\Users\Admin\AppData\Local\Temp\97ddeb89894ee7f8eb10be0510503a56.exe
"C:\Users\Admin\AppData\Local\Temp\97ddeb89894ee7f8eb10be0510503a56.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 88
  2⤵
  - Program crash
  PID:2184

memory/3056-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3056-1-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3056-2-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download