f51758a4ffcc72339f97edd1396f358f99b62d1d81a4570efa0e2f7004741eb7

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 22:21

Target

cc676eaa196e107344e3b91812953a4a.exe
Size

114KB
MD5

cc676eaa196e107344e3b91812953a4a
SHA1

8c53a7c2cad3cd76f69af19cc821a6ea8ecb00b4
SHA256

f51758a4ffcc72339f97edd1396f358f99b62d1d81a4570efa0e2f7004741eb7
SHA512

6f6cac070d082fe268ca0370babff5587becb06d17c86f9b983a7ae8b2d37f4c94a69e9412b8436a797503a3032e7493e4aa57b5509b85931b42e5f1891859f5
SSDEEP

3072:2kz9ooHCEOJW9UQiO8m81uKTReW40KJynsmmw3PYi/wLWc:2gzipcUQiO8m81uGgFyjmwgi/A

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1244	2108	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 1244	2108	cc676eaa196e107344e3b91812953a4a.exe	28
PID 2108 wrote to memory of 1244	2108	cc676eaa196e107344e3b91812953a4a.exe	28
PID 2108 wrote to memory of 1244	2108	cc676eaa196e107344e3b91812953a4a.exe	28
PID 2108 wrote to memory of 1244	2108	cc676eaa196e107344e3b91812953a4a.exe	28

C:\Users\Admin\AppData\Local\Temp\cc676eaa196e107344e3b91812953a4a.exe
"C:\Users\Admin\AppData\Local\Temp\cc676eaa196e107344e3b91812953a4a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 36
  2⤵
  - Program crash
  PID:1244

memory/2108-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2108-1-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download