17ba93a49559d2878f67257052df941dbd70ae2fbebd05c4972d80413723e5b3

Analysis

max time kernel
123s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 00:53

Target

c48d2c8cda239ce2d0aaa2d0f035d0ac.exe
Size

159KB
MD5

c48d2c8cda239ce2d0aaa2d0f035d0ac
SHA1

b0fbb650c2b66378a695e2ca3b5d0eb79a3f5b12
SHA256

17ba93a49559d2878f67257052df941dbd70ae2fbebd05c4972d80413723e5b3
SHA512

8f3e7587919aa7e5abf210ac30aa6a19437b5d5e3ed6b00c3dd509304af384bf3b3747097a70221b71e8ae6af958f2def507d6f1bf18077903fc3e306cde29e0
SSDEEP

3072:RxE4koXQGEUK7Dt4rOdLrTWcBWncnyIixDfk0fBySavqRkrbRmKMVX0tic:RCTogGEUK7JfNWyyIaDM2laiqRmh+r

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
928	2056	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 928	2056	c48d2c8cda239ce2d0aaa2d0f035d0ac.exe	27
PID 2056 wrote to memory of 928	2056	c48d2c8cda239ce2d0aaa2d0f035d0ac.exe	27
PID 2056 wrote to memory of 928	2056	c48d2c8cda239ce2d0aaa2d0f035d0ac.exe	27
PID 2056 wrote to memory of 928	2056	c48d2c8cda239ce2d0aaa2d0f035d0ac.exe	27

C:\Users\Admin\AppData\Local\Temp\c48d2c8cda239ce2d0aaa2d0f035d0ac.exe
"C:\Users\Admin\AppData\Local\Temp\c48d2c8cda239ce2d0aaa2d0f035d0ac.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 36
  2⤵
  - Program crash
  PID:928

memory/2056-0-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2056-1-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download