bdd93687714fa8b59406aaeba8b13da3c890a4231f73449be24d1813d3c1f330

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 19:10

Target

c963556dafd6ad56873d63e1fa8d26ad.exe
Size

1.0MB
MD5

c963556dafd6ad56873d63e1fa8d26ad
SHA1

d2391423d72f36e5d3f367e3e82aa2e6a83ea26b
SHA256

bdd93687714fa8b59406aaeba8b13da3c890a4231f73449be24d1813d3c1f330
SHA512

456e7dab3f26ac49082b2f9869718de2759e6caeab58b71a92a3d83f3b6fbdb75da3c3407ae828f4fc53898809c902751503ea69bf3e6e81e4bdafe4c0ef26d7
SSDEEP

12288:7PW0dZCxeKCGyJaG7A9W+eRQkt4P5H3QPwaP/+eWkOcuivycVQWhd8KpE:1dYe+yJamahHgRkriqWh6Z

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	2172	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 1708	2172	c963556dafd6ad56873d63e1fa8d26ad.exe	28
PID 2172 wrote to memory of 1708	2172	c963556dafd6ad56873d63e1fa8d26ad.exe	28
PID 2172 wrote to memory of 1708	2172	c963556dafd6ad56873d63e1fa8d26ad.exe	28
PID 2172 wrote to memory of 1708	2172	c963556dafd6ad56873d63e1fa8d26ad.exe	28

C:\Users\Admin\AppData\Local\Temp\c963556dafd6ad56873d63e1fa8d26ad.exe
"C:\Users\Admin\AppData\Local\Temp\c963556dafd6ad56873d63e1fa8d26ad.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 88
  2⤵
  - Program crash
  PID:1708