03836e184f6b48e1b82b29a415614105356237b4d192cbd2ab45c38cbf41ebb2

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 11:21

Target

abc2dc06a66de9ad6ab608428d85c864.exe
Size

66KB
MD5

abc2dc06a66de9ad6ab608428d85c864
SHA1

d794dc33daff8f0ffcf7c0d68e39c435e5c62c77
SHA256

03836e184f6b48e1b82b29a415614105356237b4d192cbd2ab45c38cbf41ebb2
SHA512

b7289eb73e3d382c04f2694fed8e0369684e5b2a8deb3c1ca555502d3e07660ba5dd6b167e2a70df6efc14dfa9b7afd8dbb0c1fbb09ce9a893442dbba8375773
SSDEEP

1536:+QD/Idapi0pV+fhpl44cwon+/8S9u6AJgxsKci0OeNlCMR:pgdapRpsZLvtonE8SQPJSsc0OylC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2248	2184	WerFault.exe	8

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2248	2184	abc2dc06a66de9ad6ab608428d85c864.exe	28
PID 2184 wrote to memory of 2248	2184	abc2dc06a66de9ad6ab608428d85c864.exe	28
PID 2184 wrote to memory of 2248	2184	abc2dc06a66de9ad6ab608428d85c864.exe	28
PID 2184 wrote to memory of 2248	2184	abc2dc06a66de9ad6ab608428d85c864.exe	28

C:\Users\Admin\AppData\Local\Temp\abc2dc06a66de9ad6ab608428d85c864.exe
"C:\Users\Admin\AppData\Local\Temp\abc2dc06a66de9ad6ab608428d85c864.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 120
  2⤵
  - Program crash
  PID:2248

memory/2184-0-0x0000000000400000-0x0000000000415958-memory.dmp

Filesize
86KB

Download