dd2bb26f24a29fc1ed8ffb311d2661d688b5e1c5ce2775fc539e23a20fec6832

Analysis

max time kernel
143s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 07:09

Target

c8025f320688a16ebcdc925b7ae8aba3.exe
Size

306KB
MD5

c8025f320688a16ebcdc925b7ae8aba3
SHA1

f37226ccab69fbd1d2c4d87a91de57ebed2a601f
SHA256

dd2bb26f24a29fc1ed8ffb311d2661d688b5e1c5ce2775fc539e23a20fec6832
SHA512

db6546c6c7da42d36a354c7599ecccd2097356d4678a7cafe7b6e4f6eece70167ca7b2622b44bbaddf1b63be266fa4a0d89e1d9d9d71716bb906b331bcd6aaf5
SSDEEP

6144:fw+ODw58qBloUmqBlofqBloa6XJbSmvkCUlbDnkP+6bknkP+6bkynkP+6bInkP+0:fZOU58SlsSliSlb6XVXPU1I+Y+J+k+0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2960	1896	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2960	1896	c8025f320688a16ebcdc925b7ae8aba3.exe	28
PID 1896 wrote to memory of 2960	1896	c8025f320688a16ebcdc925b7ae8aba3.exe	28
PID 1896 wrote to memory of 2960	1896	c8025f320688a16ebcdc925b7ae8aba3.exe	28
PID 1896 wrote to memory of 2960	1896	c8025f320688a16ebcdc925b7ae8aba3.exe	28

C:\Users\Admin\AppData\Local\Temp\c8025f320688a16ebcdc925b7ae8aba3.exe
"C:\Users\Admin\AppData\Local\Temp\c8025f320688a16ebcdc925b7ae8aba3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 88
  2⤵
  - Program crash
  PID:2960

memory/1896-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1896-1-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download