89ad30e8481ecd70fec07864d9273d191af4a71d972563f0c2032889611517de

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 07:08

Target

9692510d39596b09139baf57c6160255.exe
Size

53KB
MD5

9692510d39596b09139baf57c6160255
SHA1

91499b777f2a31434a7af705621d7238923fd81e
SHA256

89ad30e8481ecd70fec07864d9273d191af4a71d972563f0c2032889611517de
SHA512

cf4bca8e1cbefc3d9423673723d5a133cc74cc8f9913e90fac542facadb52fcc410376e36a236883b4121f050fd7caacf362dcd085ca8af0a8a3ec122ac8a3d3
SSDEEP

768:esKrYGnjddoyMhjTjEewrUEqBWkyGC3o7U6ocwRyYekdwWRbYm:x+zjoyMt/EewrpqBD/o9eeYm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2268	2408	WerFault.exe	12

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2268	2408	9692510d39596b09139baf57c6160255.exe	28
PID 2408 wrote to memory of 2268	2408	9692510d39596b09139baf57c6160255.exe	28
PID 2408 wrote to memory of 2268	2408	9692510d39596b09139baf57c6160255.exe	28
PID 2408 wrote to memory of 2268	2408	9692510d39596b09139baf57c6160255.exe	28

C:\Users\Admin\AppData\Local\Temp\9692510d39596b09139baf57c6160255.exe
"C:\Users\Admin\AppData\Local\Temp\9692510d39596b09139baf57c6160255.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 172
  2⤵
  - Program crash
  PID:2268

memory/2408-0-0x0000000001160000-0x0000000001243000-memory.dmp

Filesize
908KB

Download
memory/2408-1-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/2408-2-0x0000000001160000-0x0000000001243000-memory.dmp

Filesize
908KB

Download
memory/2408-9-0x0000000001160000-0x0000000001243000-memory.dmp

Filesize
908KB

Download