96b2160da785abf50af26520f1bc1743e962f24bf983b5ddee8591bdedd0f035

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 12:31

Target

96b2160da785abf50af26520f1bc1743e962f24bf983b5ddee8591bdedd0f035.exe
Size

264KB
MD5

e7da3b39d61565fb641804fb60beb7a3
SHA1

f8af3b94fc7a5d3eb896cce88eb94d135c05cd40
SHA256

96b2160da785abf50af26520f1bc1743e962f24bf983b5ddee8591bdedd0f035
SHA512

a84da4ed4909ec47afd26b4e657f9a322b86bd979d22bc82e0ef129776c214a0f055130f25eb69830a733bf487d187a83fac5c43284090c18e7a461459d12fa8
SSDEEP

6144:dsTwoC2FJPr3v4jk1D/+R6a2KJVu71R4U7MI:dscoC27P0jKT+oTKJVk1R4U7b

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2484	2848	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2848	96b2160da785abf50af26520f1bc1743e962f24bf983b5ddee8591bdedd0f035.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2484	2848	96b2160da785abf50af26520f1bc1743e962f24bf983b5ddee8591bdedd0f035.exe	28
PID 2848 wrote to memory of 2484	2848	96b2160da785abf50af26520f1bc1743e962f24bf983b5ddee8591bdedd0f035.exe	28
PID 2848 wrote to memory of 2484	2848	96b2160da785abf50af26520f1bc1743e962f24bf983b5ddee8591bdedd0f035.exe	28
PID 2848 wrote to memory of 2484	2848	96b2160da785abf50af26520f1bc1743e962f24bf983b5ddee8591bdedd0f035.exe	28

C:\Users\Admin\AppData\Local\Temp\96b2160da785abf50af26520f1bc1743e962f24bf983b5ddee8591bdedd0f035.exe
"C:\Users\Admin\AppData\Local\Temp\96b2160da785abf50af26520f1bc1743e962f24bf983b5ddee8591bdedd0f035.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 36
  2⤵
  - Program crash
  PID:2484

memory/2848-0-0x0000000000110000-0x0000000000152C64-memory.dmp

Filesize
267KB

Download
memory/2848-1-0x0000000000110000-0x0000000000152C64-memory.dmp

Filesize
267KB

Download
memory/2848-2-0x00000000009A0000-0x0000000000CA3000-memory.dmp

Filesize
3.0MB

Download
memory/2848-3-0x0000000000110000-0x0000000000152C64-memory.dmp

Filesize
267KB

Download