753c0612f4d0505ece10739723746ec129fb87368dfc2d219d0792cc224d054a

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 06:32

Target

a31dc06b470589237f87849cec8a7ee3.exe
Size

106KB
MD5

a31dc06b470589237f87849cec8a7ee3
SHA1

95abf1e66c1d0d632cdf08aec46bed8d7175ca7f
SHA256

753c0612f4d0505ece10739723746ec129fb87368dfc2d219d0792cc224d054a
SHA512

a0fa1420fa74a1ac5111861d03e6876fc7c55c73f53f0ef10dbda2c417c560eb8c62df223b1022b0144059a1e71e34a603674beb4df9bf9e46efe1a5a9f11ca0
SSDEEP

1536:U+FDoKtniY1u7Nn2JFkC2styJjCKICFjC7EWisS+5mlatSfkZ:U+FDzK71QkbstyJjCKICpC72s/mlaX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2248	1084	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 2248	1084	a31dc06b470589237f87849cec8a7ee3.exe	25
PID 1084 wrote to memory of 2248	1084	a31dc06b470589237f87849cec8a7ee3.exe	25
PID 1084 wrote to memory of 2248	1084	a31dc06b470589237f87849cec8a7ee3.exe	25
PID 1084 wrote to memory of 2248	1084	a31dc06b470589237f87849cec8a7ee3.exe	25

C:\Users\Admin\AppData\Local\Temp\a31dc06b470589237f87849cec8a7ee3.exe
"C:\Users\Admin\AppData\Local\Temp\a31dc06b470589237f87849cec8a7ee3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 124
  2⤵
  - Program crash
  PID:2248

memory/1084-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download