695dd612519c2ae20f07c61c0c9b65b1581cc461150bc864496f8f2493f91e9b

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
04/05/2023, 01:15

Target

245c6e8516b3c1080ede327c785e019e.exe
Size

82KB
MD5

245c6e8516b3c1080ede327c785e019e
SHA1

e385209f867b1eefa5f9aed71148a9cff1d043a9
SHA256

695dd612519c2ae20f07c61c0c9b65b1581cc461150bc864496f8f2493f91e9b
SHA512

125296435e84583cd11065b19c645edeac9d59a5630c6549ac4c4697e5bc0f79261dc8c79aa207e40440ef8f87f80cc5e31c7cbbb480eeb7f9984aea816295e8
SSDEEP

1536:yRplh2vPCXcB43ky9nvkv8l1Iz6qHwMaLTfd9shVaLWE7e9d:yRvhIPCDkscv8M6Hv9sPaL7e9d

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1564	1704	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1564	1704	245c6e8516b3c1080ede327c785e019e.exe	28
PID 1704 wrote to memory of 1564	1704	245c6e8516b3c1080ede327c785e019e.exe	28
PID 1704 wrote to memory of 1564	1704	245c6e8516b3c1080ede327c785e019e.exe	28
PID 1704 wrote to memory of 1564	1704	245c6e8516b3c1080ede327c785e019e.exe	28

C:\Users\Admin\AppData\Local\Temp\245c6e8516b3c1080ede327c785e019e.exe
"C:\Users\Admin\AppData\Local\Temp\245c6e8516b3c1080ede327c785e019e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 544
  2⤵
  - Program crash
  PID:1564

memory/1704-54-0x0000000000E70000-0x0000000000E8C000-memory.dmp

Filesize
112KB

Download