782c9da9a1b21d3a398df7743bc45737863d16dbc526a4127a56d30c815eba1c

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 12:50

Target

d6299ccf9207dd47885119b8c46800e3.exe
Size

194KB
MD5

d6299ccf9207dd47885119b8c46800e3
SHA1

19a235f9dd1d0738b1663852c5dbf5159dc0dfb0
SHA256

782c9da9a1b21d3a398df7743bc45737863d16dbc526a4127a56d30c815eba1c
SHA512

b6b5d1be988caa907684731b7b36068079d63c4779c1014161a709e45126cc1c307bbe60aec67538db104516855536939b57a9c333b3c5a1b8ab8963c4433671
SSDEEP

3072:8RXn3k0CdM1vabyzJYWqSoB1XvhGzuiL+rA89jpkGqx/:8R30LS6VjBlUi3s89jiGqx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2800	2324	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2800	2324	d6299ccf9207dd47885119b8c46800e3.exe	28
PID 2324 wrote to memory of 2800	2324	d6299ccf9207dd47885119b8c46800e3.exe	28
PID 2324 wrote to memory of 2800	2324	d6299ccf9207dd47885119b8c46800e3.exe	28
PID 2324 wrote to memory of 2800	2324	d6299ccf9207dd47885119b8c46800e3.exe	28

C:\Users\Admin\AppData\Local\Temp\d6299ccf9207dd47885119b8c46800e3.exe
"C:\Users\Admin\AppData\Local\Temp\d6299ccf9207dd47885119b8c46800e3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 156
  2⤵
  - Program crash
  PID:2800

memory/2324-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download