686ef0819874b2ecacab497e2c818e0e801fc42a920068a33e415dd1801a0c3f

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 11:36

Target

a3aec9130af6f69c715dc6eb89949079.exe
Size

77KB
MD5

a3aec9130af6f69c715dc6eb89949079
SHA1

57049307751ccdd5c870195ed2ae9f6efd0423ba
SHA256

686ef0819874b2ecacab497e2c818e0e801fc42a920068a33e415dd1801a0c3f
SHA512

be98df1cea7a840b3bc46e3512ceeea5ad94b9af8b04ccf1ecf54de41b0036f4cb130a9d613aa7f0d0ce96a23dec5410e73ec76cdc795a5528ea1d6dc261d5f1
SSDEEP

768:OBY52H8118qMsP+QN78fZaTpEgPuiY+CdRoZfJRdZudpL9+J5XMbu1YbiOYkrWcQ:Owu4WZaTfDD6qRCdph+CuRknQrgID

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2184	2480	WerFault.exe	11

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2184	2480	a3aec9130af6f69c715dc6eb89949079.exe	28
PID 2480 wrote to memory of 2184	2480	a3aec9130af6f69c715dc6eb89949079.exe	28
PID 2480 wrote to memory of 2184	2480	a3aec9130af6f69c715dc6eb89949079.exe	28
PID 2480 wrote to memory of 2184	2480	a3aec9130af6f69c715dc6eb89949079.exe	28

C:\Users\Admin\AppData\Local\Temp\a3aec9130af6f69c715dc6eb89949079.exe
"C:\Users\Admin\AppData\Local\Temp\a3aec9130af6f69c715dc6eb89949079.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 100
  2⤵
  - Program crash
  PID:2184

memory/2480-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download