eb298bcb85ad58e2be3b5fd3ea6a20f3ea23f9c0d9bbabedfea80982aac623d4

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 17:37

Target

a461d988d1efcb86a41f3b134e30d9a2.exe
Size

150KB
MD5

a461d988d1efcb86a41f3b134e30d9a2
SHA1

f38fb0c58dd231431845ffaecd9f5d398692d4e7
SHA256

eb298bcb85ad58e2be3b5fd3ea6a20f3ea23f9c0d9bbabedfea80982aac623d4
SHA512

e6a44bdcbb78210c75bfeab431a80252c2b219ecb2805aaf578cb4033625bc1430c7151920fcd89f83b4d2c61e181cc692ced2b94ef21169a02fd6fe587160fa
SSDEEP

1536:X7B205YSqJ1+qpgPp44YAJOXAFRgD0Ac0Fbtc3zpE0UmFohUpJPKGtypvbykE:XA2YSy1lgPp44YmOjnb4GmuyJPHtydby

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2216	1904	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2216	1904	a461d988d1efcb86a41f3b134e30d9a2.exe	28
PID 1904 wrote to memory of 2216	1904	a461d988d1efcb86a41f3b134e30d9a2.exe	28
PID 1904 wrote to memory of 2216	1904	a461d988d1efcb86a41f3b134e30d9a2.exe	28
PID 1904 wrote to memory of 2216	1904	a461d988d1efcb86a41f3b134e30d9a2.exe	28

C:\Users\Admin\AppData\Local\Temp\a461d988d1efcb86a41f3b134e30d9a2.exe
"C:\Users\Admin\AppData\Local\Temp\a461d988d1efcb86a41f3b134e30d9a2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 144
  2⤵
  - Program crash
  PID:2216

memory/1904-0-0x0000000000400000-0x00000000004255D1-memory.dmp

Filesize
149KB

Download
memory/1904-1-0x0000000000400000-0x00000000004255D1-memory.dmp

Filesize
149KB

Download