7ded6ba391e4573e757ddbdb7ebf4f97058706d7223f42114f942e590e1fe875

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 13:26

Target

c0b404099709c886205e98de21d6dae2.exe
Size

83KB
MD5

c0b404099709c886205e98de21d6dae2
SHA1

5362e359ba229713abca712fb9647d787b385021
SHA256

7ded6ba391e4573e757ddbdb7ebf4f97058706d7223f42114f942e590e1fe875
SHA512

d737c34b4e6137f1c8fbf0f4dbf9e6bff7fe142a12b9ee8c519f191e5061e3f2f28bebc2285ac93eee030df35b95712b759de3dddaeb834b9011b68dde3d6ed4
SSDEEP

1536:9///ozDPnfhtevy5hjjtob1esy16ZFSjEErxTWDTMqhGKYIZTET8bDQ:m/nfdHpOesKCUjBkMqhGKZTbbc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2216	2168	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2216	2168	c0b404099709c886205e98de21d6dae2.exe	28
PID 2168 wrote to memory of 2216	2168	c0b404099709c886205e98de21d6dae2.exe	28
PID 2168 wrote to memory of 2216	2168	c0b404099709c886205e98de21d6dae2.exe	28
PID 2168 wrote to memory of 2216	2168	c0b404099709c886205e98de21d6dae2.exe	28

C:\Users\Admin\AppData\Local\Temp\c0b404099709c886205e98de21d6dae2.exe
"C:\Users\Admin\AppData\Local\Temp\c0b404099709c886205e98de21d6dae2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 36
  2⤵
  - Program crash
  PID:2216

memory/2168-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download