acef025c696cc2fd22693175f0e7127a67fee93ed025dac822332a85ca33585d

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 10:59

Target

ddd8dbd3ae581e9b0d7f5a31eaa583f4.exe
Size

54KB
MD5

ddd8dbd3ae581e9b0d7f5a31eaa583f4
SHA1

789d02e1af3353198419d47f5886573adb2577e2
SHA256

acef025c696cc2fd22693175f0e7127a67fee93ed025dac822332a85ca33585d
SHA512

a87cc147c54b05b9555656015d4453d94c6d0dd628c52b26227a043fbf176cfc051bca77e077b1d05709565d262ff99c5837658f88759eaee233ec210a9c8d45
SSDEEP

1536:SbZyn5nQzgq9VL3p+M+889thiAuiIWrPIb71Ycfy:SbZ65A3L3wj19tkcz+71YWy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1500	2224	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1500	2224	ddd8dbd3ae581e9b0d7f5a31eaa583f4.exe	28
PID 2224 wrote to memory of 1500	2224	ddd8dbd3ae581e9b0d7f5a31eaa583f4.exe	28
PID 2224 wrote to memory of 1500	2224	ddd8dbd3ae581e9b0d7f5a31eaa583f4.exe	28
PID 2224 wrote to memory of 1500	2224	ddd8dbd3ae581e9b0d7f5a31eaa583f4.exe	28

C:\Users\Admin\AppData\Local\Temp\ddd8dbd3ae581e9b0d7f5a31eaa583f4.exe
"C:\Users\Admin\AppData\Local\Temp\ddd8dbd3ae581e9b0d7f5a31eaa583f4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 92
  2⤵
  - Program crash
  PID:1500