1cea6a4d11362dca33a38432937320d7878706f44377700eedfdb5f16d634a7e

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 07:09

Target

9692b05b9645443146f2726d046d8dc3.exe
Size

427KB
MD5

9692b05b9645443146f2726d046d8dc3
SHA1

eb9f561ff37dfd28ad8e82e7fa400540ec717ca7
SHA256

1cea6a4d11362dca33a38432937320d7878706f44377700eedfdb5f16d634a7e
SHA512

519ee782cce324cf06dd8f459b18b51822b4aa6efa68e2990ec72576112ab40626807f7d46759a1b4f40fa67b55f54ca597a3edb9cf4a35b23031cfa3fe612e2
SSDEEP

6144:aiFUvYoYDm5v8DJtBTd8dbVTh2adDWAzuroj3zjlYL1Q3R8:aigYLm5EDJtBJ8hrlurovhfR8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2436	2996	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2436	2996	9692b05b9645443146f2726d046d8dc3.exe	16
PID 2996 wrote to memory of 2436	2996	9692b05b9645443146f2726d046d8dc3.exe	16
PID 2996 wrote to memory of 2436	2996	9692b05b9645443146f2726d046d8dc3.exe	16
PID 2996 wrote to memory of 2436	2996	9692b05b9645443146f2726d046d8dc3.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 116
1⤵
- Program crash
PID:2436

C:\Users\Admin\AppData\Local\Temp\9692b05b9645443146f2726d046d8dc3.exe
"C:\Users\Admin\AppData\Local\Temp\9692b05b9645443146f2726d046d8dc3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2996

memory/2996-0-0x0000000000950000-0x00000000009BF000-memory.dmp

Filesize
444KB

Download