78d5fe8823786c7fb42d65325902d83de6a5ea398d40663a191003ca681cb9be

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 05:33

Target

989a0c74d747dcc1c1e298dd4ba429c2.exe
Size

216KB
MD5

989a0c74d747dcc1c1e298dd4ba429c2
SHA1

bf231599224e3596270434dd0ce523c02c76749d
SHA256

78d5fe8823786c7fb42d65325902d83de6a5ea398d40663a191003ca681cb9be
SHA512

c45696df4ff01b4dfbc7ee7f8b38f3166b002e5b4e7dd65c9cbbb803fcc70446675754209af57ca110c7bfc9bbdef63cb4d1280ddd3811e0bc9fbfb2edccc388
SSDEEP

3072:V0YgJes6iO6yxyvZcMO/6T4nIB5BAZllLMcEY0IuSNTKCrw7:V256v3AZcR/6TkINwlJM3IVhKgw7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2036	3028	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2036	3028	989a0c74d747dcc1c1e298dd4ba429c2.exe	28
PID 3028 wrote to memory of 2036	3028	989a0c74d747dcc1c1e298dd4ba429c2.exe	28
PID 3028 wrote to memory of 2036	3028	989a0c74d747dcc1c1e298dd4ba429c2.exe	28
PID 3028 wrote to memory of 2036	3028	989a0c74d747dcc1c1e298dd4ba429c2.exe	28

C:\Users\Admin\AppData\Local\Temp\989a0c74d747dcc1c1e298dd4ba429c2.exe
"C:\Users\Admin\AppData\Local\Temp\989a0c74d747dcc1c1e298dd4ba429c2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 136
  2⤵
  - Program crash
  PID:2036

memory/3028-0-0x0000000001000000-0x0000000001031000-memory.dmp

Filesize
196KB

Download