220fe23a30228c363d816fb619345ab1ce40dd67541ec6b17083a45c67cc4a9b

Resubmissions

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 22:57

Target

220fe23a30228c363d816fb619345ab1ce40dd67541ec6b17083a45c67cc4a9b.exe
Size

421KB
MD5

0af645b0d5ba2f665c227545523fb8f6
SHA1

6b59ed2186e1554bccba0e3c3b9f517cfdaefe0a
SHA256

220fe23a30228c363d816fb619345ab1ce40dd67541ec6b17083a45c67cc4a9b
SHA512

605fae3c8eb499b2d903e0c2c539de7ef2d645486f15229ba8cd9e4c84d7680e43a7ba9c4ed264cf96cd77948dba136e223c320de88ebdade39c8410b8a6aa14
SSDEEP

12288:EwOa1fvniVvr7G6JMOCyHPocXX4brLRgx3rSDLC:EwOUniVzK6JMOxHPocn+cbSDG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2268	2868	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2268	2868	220fe23a30228c363d816fb619345ab1ce40dd67541ec6b17083a45c67cc4a9b.exe	28
PID 2868 wrote to memory of 2268	2868	220fe23a30228c363d816fb619345ab1ce40dd67541ec6b17083a45c67cc4a9b.exe	28
PID 2868 wrote to memory of 2268	2868	220fe23a30228c363d816fb619345ab1ce40dd67541ec6b17083a45c67cc4a9b.exe	28
PID 2868 wrote to memory of 2268	2868	220fe23a30228c363d816fb619345ab1ce40dd67541ec6b17083a45c67cc4a9b.exe	28

C:\Users\Admin\AppData\Local\Temp\220fe23a30228c363d816fb619345ab1ce40dd67541ec6b17083a45c67cc4a9b.exe
"C:\Users\Admin\AppData\Local\Temp\220fe23a30228c363d816fb619345ab1ce40dd67541ec6b17083a45c67cc4a9b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 64
  2⤵
  - Program crash
  PID:2268

memory/2868-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2868-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download