64b25ec844a9567388e6ddb53695d9571d3f960afee094668e8dae45aa891140

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 20:22

Target

c1833aafbc0b452713b6a9bd17bb75cd.exe
Size

667KB
MD5

c1833aafbc0b452713b6a9bd17bb75cd
SHA1

22cda665a69dfd0bb0c318455b94a45a791446d8
SHA256

64b25ec844a9567388e6ddb53695d9571d3f960afee094668e8dae45aa891140
SHA512

bd9973b9da9fb1128960e363f9d8e9bf0f731f8eb039d54abea150e38832897e7c3587b98d172a65394c1c1f3b8c53c29c3d9d807a5ba8eb1ebc83d7b48a7e7d
SSDEEP

12288:R6nXGs5NwYkK19iOCr+TMoO30mYn0YaAsGhQ8zM5DKTrH5mZQ2DZ:gXG1K19iOCr+TMoO30mYn0YaAst8zM5V

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1880	1040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 1880	1040	c1833aafbc0b452713b6a9bd17bb75cd.exe	28
PID 1040 wrote to memory of 1880	1040	c1833aafbc0b452713b6a9bd17bb75cd.exe	28
PID 1040 wrote to memory of 1880	1040	c1833aafbc0b452713b6a9bd17bb75cd.exe	28
PID 1040 wrote to memory of 1880	1040	c1833aafbc0b452713b6a9bd17bb75cd.exe	28

C:\Users\Admin\AppData\Local\Temp\c1833aafbc0b452713b6a9bd17bb75cd.exe
"C:\Users\Admin\AppData\Local\Temp\c1833aafbc0b452713b6a9bd17bb75cd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 88
  2⤵
  - Program crash
  PID:1880

memory/1040-0-0x00000000012A0000-0x0000000001349000-memory.dmp

Filesize
676KB

Download