f1f71d2a415ebf352f83c97495b13840f30fb357b36e97a38188a3879bb500e8

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/01/2023, 09:19

Target

StarPeriphery.exe
Size

267KB
MD5

1259ebb2647a024d71ca27b96a02fcb3
SHA1

af4ad5c7217260c751c4e34a9c8422bf91ada225
SHA256

f1f71d2a415ebf352f83c97495b13840f30fb357b36e97a38188a3879bb500e8
SHA512

2728954a576790924471df1a9bbff21582949b3ecdc58cb2aa91147d0d1db4f27e4a5c5967905e40c260fd471755a7167ebf52e287f4be8d2e47c57ec02693b8
SSDEEP

3072:A2bpLzQpLm2IgTclS22lBY9k8GXNrkq5akLTxrOXJXJLk/VkNzRAomeAGoM8eF4S:/NYoD8eAt8GXvEkVOXqVk7QIMeFp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1240	580	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 1240	580	StarPeriphery.exe	28
PID 580 wrote to memory of 1240	580	StarPeriphery.exe	28
PID 580 wrote to memory of 1240	580	StarPeriphery.exe	28

C:\Users\Admin\AppData\Local\Temp\StarPeriphery.exe
"C:\Users\Admin\AppData\Local\Temp\StarPeriphery.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 580 -s 56
  2⤵
  - Program crash
  PID:1240