0f88ea51a56da966d12311a4b20ea3a6c44315e00747a589f19cf535f90ced77

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 07:15

Target

97768ab0a4837757b74de2ae892badab.exe
Size

1.8MB
MD5

97768ab0a4837757b74de2ae892badab
SHA1

d8bdfdb717b64ee4cd7a892bbddd293f7eaf915c
SHA256

0f88ea51a56da966d12311a4b20ea3a6c44315e00747a589f19cf535f90ced77
SHA512

78bc5c866b12fcc82cdda20622694824b227a4d522632ffca4b6608bb5245a5e39c28e7f10dfd9e253407a922dae47a83171fb3f605597af4f7186c3aaf5dcde
SSDEEP

49152:Ktx9fJc02euDyRs7NNvZpFW3wrqirfHWZjlavwpX:Ktx9fe02beG5Nv+w+irHWZjlavwpX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1752	1044	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1752	1044	97768ab0a4837757b74de2ae892badab.exe	29
PID 1044 wrote to memory of 1752	1044	97768ab0a4837757b74de2ae892badab.exe	29
PID 1044 wrote to memory of 1752	1044	97768ab0a4837757b74de2ae892badab.exe	29
PID 1044 wrote to memory of 1752	1044	97768ab0a4837757b74de2ae892badab.exe	29

C:\Users\Admin\AppData\Local\Temp\97768ab0a4837757b74de2ae892badab.exe
"C:\Users\Admin\AppData\Local\Temp\97768ab0a4837757b74de2ae892badab.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 96
  2⤵
  - Program crash
  PID:1752

memory/1044-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download