2ae17864da62a8332284152c14643071c9b03ef426b5972fc07b83e62eea8bea

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-02-2024 03:32

Target

ad93e638fa6fad90e40e8201c72cf4b8.exe
Size

30KB
MD5

ad93e638fa6fad90e40e8201c72cf4b8
SHA1

f3a226be955eeef618d0a002be79fe334528ecc6
SHA256

2ae17864da62a8332284152c14643071c9b03ef426b5972fc07b83e62eea8bea
SHA512

067288d767b6cefc52b12302817ea7499adac4b4a5dcdd15d239ca91dd356a93e37440d97d7cd186d1909a7b89a959bdf91434f300003f63dc4e67b24f694470
SSDEEP

768:ImmOwwTFOMQ0Bk4cklAzyjoDZHlim6m/fGGPkNNx:ImLwwZBHk4BlACoDZHjvPkNv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2768	2196	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2768	2196	ad93e638fa6fad90e40e8201c72cf4b8.exe	1
PID 2196 wrote to memory of 2768	2196	ad93e638fa6fad90e40e8201c72cf4b8.exe	1
PID 2196 wrote to memory of 2768	2196	ad93e638fa6fad90e40e8201c72cf4b8.exe	1
PID 2196 wrote to memory of 2768	2196	ad93e638fa6fad90e40e8201c72cf4b8.exe	1

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 88
1⤵
- Program crash
PID:2768

C:\Users\Admin\AppData\Local\Temp\ad93e638fa6fad90e40e8201c72cf4b8.exe
"C:\Users\Admin\AppData\Local\Temp\ad93e638fa6fad90e40e8201c72cf4b8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2196