a21433d2b65d070ab1ea1c4f71c6081c15192d76e9fc82050ef1fc15615e2b8b

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 15:32

Target

a982080b208637bc1e21298019858f09.exe
Size

20KB
MD5

a982080b208637bc1e21298019858f09
SHA1

a6af5e827673ce0711b44025d602206cd5e4d2e4
SHA256

a21433d2b65d070ab1ea1c4f71c6081c15192d76e9fc82050ef1fc15615e2b8b
SHA512

0a046d3193a2265f499936100462f2d489fd22899922e6475f7e7cf48a81ba73e1987c1e83f9868e657f866977338d091c9959179b1c7d1b0332c1cf7b83464b
SSDEEP

192:KW3DEI0jbKV08PbQWKxzywf6gZWeq6mFfzUQCDs4C/w/M:NgI0j+bmXoF7CDs4C/w/M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2800	2316	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2800	2316	a982080b208637bc1e21298019858f09.exe	6
PID 2316 wrote to memory of 2800	2316	a982080b208637bc1e21298019858f09.exe	6
PID 2316 wrote to memory of 2800	2316	a982080b208637bc1e21298019858f09.exe	6
PID 2316 wrote to memory of 2800	2316	a982080b208637bc1e21298019858f09.exe	6

C:\Users\Admin\AppData\Local\Temp\a982080b208637bc1e21298019858f09.exe
"C:\Users\Admin\AppData\Local\Temp\a982080b208637bc1e21298019858f09.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 148
  2⤵
  - Program crash
  PID:2800

memory/2316-0-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download