0b9d90126070f7ff295a81fb4e70c074a0dc67a401042f4b9786e0d08f370765

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 09:24

Target

ded379598d77e4510d040488f02afb81.exe
Size

165KB
MD5

ded379598d77e4510d040488f02afb81
SHA1

50c6d88f453240c3e59179f698135ae180017f62
SHA256

0b9d90126070f7ff295a81fb4e70c074a0dc67a401042f4b9786e0d08f370765
SHA512

44af3dc96b476b027bbf785f7a3132480d8eb5803bbc020c2b0751c7e95a90582386adecd9fcb19266f7a780b20f654db8dec659e1f4caa713e6b232566f1d99
SSDEEP

1536:OeVswRd9toAiDGjhKEylzdctChfIWmieg7/8yoW3dABffVa2pYyi8YUf+7MQ:OeqwRhicEn5I1a75oW3WpdxYYYUfbQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1612	2000	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1612	2000	ded379598d77e4510d040488f02afb81.exe	28
PID 2000 wrote to memory of 1612	2000	ded379598d77e4510d040488f02afb81.exe	28
PID 2000 wrote to memory of 1612	2000	ded379598d77e4510d040488f02afb81.exe	28
PID 2000 wrote to memory of 1612	2000	ded379598d77e4510d040488f02afb81.exe	28

C:\Users\Admin\AppData\Local\Temp\ded379598d77e4510d040488f02afb81.exe
"C:\Users\Admin\AppData\Local\Temp\ded379598d77e4510d040488f02afb81.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 88
  2⤵
  - Program crash
  PID:1612

memory/2000-0-0x0000000000150000-0x0000000000181000-memory.dmp

Filesize
196KB

Download