01ab56744eb9f0584618badcfc88e0223faa6e3d038abeb24ad6a7b8a2b62feb

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 07:32

Target

a337a96a8e4a18ebb5084ac5f34d9091.exe
Size

56KB
MD5

a337a96a8e4a18ebb5084ac5f34d9091
SHA1

b4d5790f2d11d236da4f24f9088d7ab47967126e
SHA256

01ab56744eb9f0584618badcfc88e0223faa6e3d038abeb24ad6a7b8a2b62feb
SHA512

1a3e26e97be75a58e2133426b58c3ea6cd23d22cbe08a6e3971e198b27bc0de6ee7e010278f6d43f5d1b5e922a3c75c49587202b92d1cd034c53e4a0ed92a558
SSDEEP

1536:7ISXz8Oxj9i1rBrAGTaY/YyaTyweRt5ekgETcugkEC0I:Dj9+rtAGaeDRtIETJVEFI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2960	1528	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 2960	1528	a337a96a8e4a18ebb5084ac5f34d9091.exe	28
PID 1528 wrote to memory of 2960	1528	a337a96a8e4a18ebb5084ac5f34d9091.exe	28
PID 1528 wrote to memory of 2960	1528	a337a96a8e4a18ebb5084ac5f34d9091.exe	28
PID 1528 wrote to memory of 2960	1528	a337a96a8e4a18ebb5084ac5f34d9091.exe	28

C:\Users\Admin\AppData\Local\Temp\a337a96a8e4a18ebb5084ac5f34d9091.exe
"C:\Users\Admin\AppData\Local\Temp\a337a96a8e4a18ebb5084ac5f34d9091.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 36
  2⤵
  - Program crash
  PID:2960

memory/1528-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1528-1-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download