690dd94889b4f313ef4ac0b6ef9f5dc5f0728f34092b65ee68e61bd10af48a53

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 06:41

Target

c01b5c7c2ef1ffe3481e4b4c3f3e50a4.exe
Size

227KB
MD5

c01b5c7c2ef1ffe3481e4b4c3f3e50a4
SHA1

0a9dc603ed0dda03d0e45cd3fa06e9105f86719c
SHA256

690dd94889b4f313ef4ac0b6ef9f5dc5f0728f34092b65ee68e61bd10af48a53
SHA512

16ae4363211ee19e84b34fb84750217d26e9452c1de364dbe4a4d0f0abbbfce36f3a7093a922ad81bda27e27f68d8eae1b7e9cc25046df6aaa4d8a01d35134a3
SSDEEP

3072:DA3j1PgpirbVPkaCoYvpgJzoK/K4UWWhyeHQZ9skJN+99ybrG53ZY3gz:YhPYirbVPFCoYBU/K9Jpk9R3S3a3e

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1944	1684	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1944	1684	c01b5c7c2ef1ffe3481e4b4c3f3e50a4.exe	28
PID 1684 wrote to memory of 1944	1684	c01b5c7c2ef1ffe3481e4b4c3f3e50a4.exe	28
PID 1684 wrote to memory of 1944	1684	c01b5c7c2ef1ffe3481e4b4c3f3e50a4.exe	28
PID 1684 wrote to memory of 1944	1684	c01b5c7c2ef1ffe3481e4b4c3f3e50a4.exe	28

C:\Users\Admin\AppData\Local\Temp\c01b5c7c2ef1ffe3481e4b4c3f3e50a4.exe
"C:\Users\Admin\AppData\Local\Temp\c01b5c7c2ef1ffe3481e4b4c3f3e50a4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 88
  2⤵
  - Program crash
  PID:1944

memory/1684-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download