cffda562cf9b9c0e25691a9b8766ec4d75f3434cda1c4a2052ae70e6150637e9

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/02/2024, 04:34

Target

adb4679f917ac1cec238395bfd71071b.exe
Size

102KB
MD5

adb4679f917ac1cec238395bfd71071b
SHA1

0e0bdd6f3d5817f4bb35a831d13922401774bc1a
SHA256

cffda562cf9b9c0e25691a9b8766ec4d75f3434cda1c4a2052ae70e6150637e9
SHA512

3bbef147aafb3f11bd11a2b4005257135986750c6b1d23cf76fa013da66e5d0d1db4f4fcf194217b156eb604e820230ca7ab9ec6964c1abfbe8efb936ba12e72
SSDEEP

1536:Srq7pdE+PUF4+3FTIOsRjvyXZIIWaTwhsuVjL/8cQBBnIeKaPsR4eiz:AqndMCGFTIPRjvyDWyhuVn/84aGJi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2052	1056	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 2052	1056	adb4679f917ac1cec238395bfd71071b.exe	28
PID 1056 wrote to memory of 2052	1056	adb4679f917ac1cec238395bfd71071b.exe	28
PID 1056 wrote to memory of 2052	1056	adb4679f917ac1cec238395bfd71071b.exe	28
PID 1056 wrote to memory of 2052	1056	adb4679f917ac1cec238395bfd71071b.exe	28

C:\Users\Admin\AppData\Local\Temp\adb4679f917ac1cec238395bfd71071b.exe
"C:\Users\Admin\AppData\Local\Temp\adb4679f917ac1cec238395bfd71071b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 148
  2⤵
  - Program crash
  PID:2052

memory/1056-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download