d844b8fbb4b7666fb9282e6417bbef2097607dbee9879e97f6875f626b746371

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 12:07

Target

9962f503f56bac8a613b855a371ced08.exe
Size

103KB
MD5

9962f503f56bac8a613b855a371ced08
SHA1

f72920dcf2264d048d08923fd640aaa22d074fba
SHA256

d844b8fbb4b7666fb9282e6417bbef2097607dbee9879e97f6875f626b746371
SHA512

cd18f3013f8e9ad9a944a53bb31354b466406b16268440d1eddaaf1ba4c5c77fb3d5ed623edb791b24c14e0873f3d688899910e84f4028d16b12c251167eb98a
SSDEEP

1536:m35XPdUbL/49CkvEW28jSBUUy7PVaMx0kdxa+cl9WDht6KS2TGZyVldENYBAG4p:mJ2H4vEJLm9a2kWdQ5WGZe3E2BAGm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2176	2376	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2176	2376	9962f503f56bac8a613b855a371ced08.exe	26
PID 2376 wrote to memory of 2176	2376	9962f503f56bac8a613b855a371ced08.exe	26
PID 2376 wrote to memory of 2176	2376	9962f503f56bac8a613b855a371ced08.exe	26
PID 2376 wrote to memory of 2176	2376	9962f503f56bac8a613b855a371ced08.exe	26

C:\Users\Admin\AppData\Local\Temp\9962f503f56bac8a613b855a371ced08.exe
"C:\Users\Admin\AppData\Local\Temp\9962f503f56bac8a613b855a371ced08.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 36
  2⤵
  - Program crash
  PID:2176

memory/2376-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download