2ac9ce8da4fd13d2c6e069365ebeab73eecc3dcea4759b8787da711d4ae24dfb

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
18-03-2024 15:57

Target

2ac9ce8da4fd13d2c6e069365ebeab73eecc3dcea4759b8787da711d4ae24dfb.exe
Size

5KB
MD5

3923a8c79ab11fc275f0b99b97b01fcb
SHA1

37e9ca4451e7332a333ac65954fa2f77a19dd815
SHA256

2ac9ce8da4fd13d2c6e069365ebeab73eecc3dcea4759b8787da711d4ae24dfb
SHA512

e9e281cfcdab675d17c483f722e879a7ebfb5c134752b8ac2f87303f83a943d76735a084025b56c9e0d67fd3272e79372c174c79da78a63064ec7301fb51899f
SSDEEP

48:SualXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7tNRuqSxp:lWWLkFfNnOKYloIQ2pm2pbYSbxE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2604	2252	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2604	2252	2ac9ce8da4fd13d2c6e069365ebeab73eecc3dcea4759b8787da711d4ae24dfb.exe	28
PID 2252 wrote to memory of 2604	2252	2ac9ce8da4fd13d2c6e069365ebeab73eecc3dcea4759b8787da711d4ae24dfb.exe	28
PID 2252 wrote to memory of 2604	2252	2ac9ce8da4fd13d2c6e069365ebeab73eecc3dcea4759b8787da711d4ae24dfb.exe	28
PID 2252 wrote to memory of 2604	2252	2ac9ce8da4fd13d2c6e069365ebeab73eecc3dcea4759b8787da711d4ae24dfb.exe	28

C:\Users\Admin\AppData\Local\Temp\2ac9ce8da4fd13d2c6e069365ebeab73eecc3dcea4759b8787da711d4ae24dfb.exe
"C:\Users\Admin\AppData\Local\Temp\2ac9ce8da4fd13d2c6e069365ebeab73eecc3dcea4759b8787da711d4ae24dfb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 48
  2⤵
  - Program crash
  PID:2604