fb721cf81d04d76949070bd034bb2d5a285f502fb2fc7be91ac0d2db813a06e0

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 08:21

Target

cd913ebe3fe549b4019cb0101f71a3b1.exe
Size

96KB
MD5

cd913ebe3fe549b4019cb0101f71a3b1
SHA1

1d356ec4389e3c860463af3c27bead8833fab567
SHA256

fb721cf81d04d76949070bd034bb2d5a285f502fb2fc7be91ac0d2db813a06e0
SHA512

ca434256ef876f3a259b1b8240040620b30bb3754c2961ecee272312e268a56c91e9eca37cbae0a75c901aca15287035e58fb51b555155805dc96395947201da
SSDEEP

1536:jsWEsQ5eWJ3hoLNyrIpMM6wnUAiVbwa216xc+8ro/LYLsowTZobH/Z+:Q1IKMlnxixwa2VY/8ADTZ2Z

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2968	2520	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2968	2520	cd913ebe3fe549b4019cb0101f71a3b1.exe	28
PID 2520 wrote to memory of 2968	2520	cd913ebe3fe549b4019cb0101f71a3b1.exe	28
PID 2520 wrote to memory of 2968	2520	cd913ebe3fe549b4019cb0101f71a3b1.exe	28
PID 2520 wrote to memory of 2968	2520	cd913ebe3fe549b4019cb0101f71a3b1.exe	28

C:\Users\Admin\AppData\Local\Temp\cd913ebe3fe549b4019cb0101f71a3b1.exe
"C:\Users\Admin\AppData\Local\Temp\cd913ebe3fe549b4019cb0101f71a3b1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 36
  2⤵
  - Program crash
  PID:2968

memory/2520-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download