6912b0459dff59929c825f514dd44d9f2c5af2e05c354f64dbde24392ad2c936

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 03:05

Target

96148e29fac6f8460df3453a173f6663.exe
Size

367KB
MD5

96148e29fac6f8460df3453a173f6663
SHA1

18ece3dee6ae4617aa6b3c8770bcd575ec5c2f0f
SHA256

6912b0459dff59929c825f514dd44d9f2c5af2e05c354f64dbde24392ad2c936
SHA512

7cf104c11e5bf0d31d809c4f5338c07ed80f0e8e75ec93477a6fcf369125a5c044671c85f901c34c1b6e921ee78bbf2d48fc5e562609a04c71d61a542ac66c1c
SSDEEP

6144:rpEcAd/Mm5ZkyUneRTnJOmQ4W4/6zA5K0TzJRCp4xRvKUllD/W13+3:rTAOm5eyUnJmCzAXTzJR3RvK6lCw3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2220	2668	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2220	2668	96148e29fac6f8460df3453a173f6663.exe	16
PID 2668 wrote to memory of 2220	2668	96148e29fac6f8460df3453a173f6663.exe	16
PID 2668 wrote to memory of 2220	2668	96148e29fac6f8460df3453a173f6663.exe	16
PID 2668 wrote to memory of 2220	2668	96148e29fac6f8460df3453a173f6663.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 116
1⤵
- Program crash
PID:2220

C:\Users\Admin\AppData\Local\Temp\96148e29fac6f8460df3453a173f6663.exe
"C:\Users\Admin\AppData\Local\Temp\96148e29fac6f8460df3453a173f6663.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2668

memory/2668-0-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Filesize
384KB

Download