e8f1ea1a973dbb37f6e4c2bf7b2fd72cb7c192097b8f111870a67d48daf060ab

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 19:01

Target

c15df3cb57d9a45edeec674c59935ced.exe
Size

39KB
MD5

c15df3cb57d9a45edeec674c59935ced
SHA1

041e00cbe0f4a9d10750b738dd821cabb5380585
SHA256

e8f1ea1a973dbb37f6e4c2bf7b2fd72cb7c192097b8f111870a67d48daf060ab
SHA512

2f85c89c75e7227d2077df03a02688c9fd93f5eff0694a8ceb7b4f7b8068121585158f4639e93a4cedd6232f2385698bbb6aaf8cf56634752aec9d498cf8fd90
SSDEEP

768:OtnTkYBMNKbqZ54y/8vI10ILAqRNoVOIyRsQRPYT7OgdiFkym/zo+gqn9:OTmKbc2I1vAqRqryRDR2aEiFkym/8/s9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1612	2200	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1612	2200	c15df3cb57d9a45edeec674c59935ced.exe	28
PID 2200 wrote to memory of 1612	2200	c15df3cb57d9a45edeec674c59935ced.exe	28
PID 2200 wrote to memory of 1612	2200	c15df3cb57d9a45edeec674c59935ced.exe	28
PID 2200 wrote to memory of 1612	2200	c15df3cb57d9a45edeec674c59935ced.exe	28

C:\Users\Admin\AppData\Local\Temp\c15df3cb57d9a45edeec674c59935ced.exe
"C:\Users\Admin\AppData\Local\Temp\c15df3cb57d9a45edeec674c59935ced.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 36
  2⤵
  - Program crash
  PID:1612

memory/2200-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2200-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download