0e94ad49cd62162bdb3d9bed11ff9a491dbc46bcd7ab16e6c99d701653822a58

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 18:06

Target

ac83e290d65800deb22871bc3699f268.exe
Size

11KB
MD5

ac83e290d65800deb22871bc3699f268
SHA1

4ae55d0c82ef1f889f069ff4e3b00dd72d98e871
SHA256

0e94ad49cd62162bdb3d9bed11ff9a491dbc46bcd7ab16e6c99d701653822a58
SHA512

be63f4e7844b807a937bd04cb7f7677f72e03e4eedc498636c03b115bf7524067a82eeeb8b938bb634545185998806abd3a5082ca00c7b50e925e8f5183b549e
SSDEEP

192:oCbPj/rK5JQZ1N9Y9wqEtrMTgsAOiAWi1Vzs7UgCtVKky/G:dbPjOaN9eEouqnw72KjG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2212	1932	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2212	1932	ac83e290d65800deb22871bc3699f268.exe	28
PID 1932 wrote to memory of 2212	1932	ac83e290d65800deb22871bc3699f268.exe	28
PID 1932 wrote to memory of 2212	1932	ac83e290d65800deb22871bc3699f268.exe	28
PID 1932 wrote to memory of 2212	1932	ac83e290d65800deb22871bc3699f268.exe	28

C:\Users\Admin\AppData\Local\Temp\ac83e290d65800deb22871bc3699f268.exe
"C:\Users\Admin\AppData\Local\Temp\ac83e290d65800deb22871bc3699f268.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 36
  2⤵
  - Program crash
  PID:2212

memory/1932-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download