2ee71902341362824726f0d9b74b09b3b4572d823181159ace0940681e270188

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 12:29

Target

a1de8a3082625ec6a3010776174e7bde.exe
Size

430KB
MD5

a1de8a3082625ec6a3010776174e7bde
SHA1

1902ec3e95eaf63022587a7f2919d45e291b7184
SHA256

2ee71902341362824726f0d9b74b09b3b4572d823181159ace0940681e270188
SHA512

35d7e70ddc5697d41b4b56d197782df47d102b0a0bc921e714169823a06e955de0a06773391892f6e9001925cd04a3e408c3b9c3b9f2eda035422189c905814d
SSDEEP

6144:Ulsy4TNbEm1B1zzqaCh9Ju/2x+vw0b8ajNglS2+gUXpP9YC4r:UdwNIm1B1zzqrh9Jf+btwSfgUnBI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2080	2356	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2080	2356	a1de8a3082625ec6a3010776174e7bde.exe	28
PID 2356 wrote to memory of 2080	2356	a1de8a3082625ec6a3010776174e7bde.exe	28
PID 2356 wrote to memory of 2080	2356	a1de8a3082625ec6a3010776174e7bde.exe	28
PID 2356 wrote to memory of 2080	2356	a1de8a3082625ec6a3010776174e7bde.exe	28

C:\Users\Admin\AppData\Local\Temp\a1de8a3082625ec6a3010776174e7bde.exe
"C:\Users\Admin\AppData\Local\Temp\a1de8a3082625ec6a3010776174e7bde.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 116
  2⤵
  - Program crash
  PID:2080

memory/2356-0-0x0000000000CB0000-0x0000000000D20000-memory.dmp

Filesize
448KB

Download