fde1893e20b2d93503a9e6168cb20cefafe5fd2991ef0e6b29fa8890b8479620

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 00:37

Target

9a55027179e00ad77b8e22e31f1c1da6.exe
Size

15KB
MD5

9a55027179e00ad77b8e22e31f1c1da6
SHA1

655d15226ef83d11cb2eebd46148ec080077da2f
SHA256

fde1893e20b2d93503a9e6168cb20cefafe5fd2991ef0e6b29fa8890b8479620
SHA512

0508d864fae93519316b6d380ec4799caef2da6daa53896d1526d17d7987ebcd089ebbebcd496be947d7e5fef7f3384613e62eb9f3b21fa62e229a03b67db4fd
SSDEEP

96:vXMtPlLBb0K7ASeDjaxeGDFak89uNItzOZmRi+NItz/c8eNItzNfBTssfhNItzMN:w7x+arak8JuwBrBkOO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2352	2332	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2352	2332	9a55027179e00ad77b8e22e31f1c1da6.exe	28
PID 2332 wrote to memory of 2352	2332	9a55027179e00ad77b8e22e31f1c1da6.exe	28
PID 2332 wrote to memory of 2352	2332	9a55027179e00ad77b8e22e31f1c1da6.exe	28
PID 2332 wrote to memory of 2352	2332	9a55027179e00ad77b8e22e31f1c1da6.exe	28

C:\Users\Admin\AppData\Local\Temp\9a55027179e00ad77b8e22e31f1c1da6.exe
"C:\Users\Admin\AppData\Local\Temp\9a55027179e00ad77b8e22e31f1c1da6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 36
  2⤵
  - Program crash
  PID:2352