0d6494a16aec93bbf79227151adcb085328b2af646f5a65b17a98b7762cd77df

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 13:39

Target

file.exe
Size

452KB
MD5

e22eb6b1c1a698104f02bbc8c2dec0dc
SHA1

e87776a3b348d4d465d7e884037a35fccbb45c48
SHA256

0d6494a16aec93bbf79227151adcb085328b2af646f5a65b17a98b7762cd77df
SHA512

b855999b1d90b28525ec3b9119d7542e2f9fc23dbebf9ed187ba56ff37a2f73adec60bbd6dcd3dcfa7eee3eec9a1e9f48068c109aaf1ad1ab7f742b493806000
SSDEEP

6144:Vn9P58Q34DMRyzxvNPWUwXtybWhR05El0iy4rBO5QjXIMOEtsdalxnh7l9DwCPPC:BNt4DMRy3R/EOSINdalxnZl9DlPSEO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1104	2784	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 1104	2784	file.exe	28
PID 2784 wrote to memory of 1104	2784	file.exe	28
PID 2784 wrote to memory of 1104	2784	file.exe	28
PID 2784 wrote to memory of 1104	2784	file.exe	28

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 68
  2⤵
  - Program crash
  PID:1104

memory/2784-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download