c4600e1b58eb1ad1e4b322171b74e82c1acffb1251ed0e3239556a8526525480

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 22:10

Target

9a099e5dd678688d94c63c8bb3b3fe50.exe
Size

89KB
MD5

9a099e5dd678688d94c63c8bb3b3fe50
SHA1

ae23be11a778e6a4e514d1fc7daf403814a4737a
SHA256

c4600e1b58eb1ad1e4b322171b74e82c1acffb1251ed0e3239556a8526525480
SHA512

7eded72407516b99757ab5a1b19d885471bd575a39e37af3943a1f2d57ccad1f3b0faf30dac713129aed98b42f35050c1c03380f9c8616f2f900a24bc4b11bec
SSDEEP

1536:v9/8efivWddr+AqOUvCGynLXBK5n3gNFFHAT7fb8O6qSPVAfsYoM:9hieD6AqvqGnoFFHAPfAXqVsYoM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2856	2672	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2856	2672	9a099e5dd678688d94c63c8bb3b3fe50.exe	28
PID 2672 wrote to memory of 2856	2672	9a099e5dd678688d94c63c8bb3b3fe50.exe	28
PID 2672 wrote to memory of 2856	2672	9a099e5dd678688d94c63c8bb3b3fe50.exe	28
PID 2672 wrote to memory of 2856	2672	9a099e5dd678688d94c63c8bb3b3fe50.exe	28

C:\Users\Admin\AppData\Local\Temp\9a099e5dd678688d94c63c8bb3b3fe50.exe
"C:\Users\Admin\AppData\Local\Temp\9a099e5dd678688d94c63c8bb3b3fe50.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 148
  2⤵
  - Program crash
  PID:2856

memory/2672-0-0x0000000001000000-0x0000000001016400-memory.dmp

Filesize
89KB

Download