73133d85eddbea96f9281bf37d91fe0dc40bf9202df3133d74b0bcccde48a2aa

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06/06/2023, 08:16

Target

SKM_C3350191107102.exe
Size

787KB
MD5

a5ce45801e46960f6e7e0f76da9a6911
SHA1

44d90f01098d734c3e5549a0522bb752e686fdd0
SHA256

73133d85eddbea96f9281bf37d91fe0dc40bf9202df3133d74b0bcccde48a2aa
SHA512

4efb8f216abcfb116c160e97866279c3d224d327bd9913fbf27ed253764e6b7738e56c4a48362bb4dd68e03b89e44055ba4dc25fbf2d6232ee757c8128d39430
SSDEEP

12288:42iNUewx/NscEQ+vgXK1HsaSj4qfS1t/YxwSWpqQu250Qvj7K1hDZ6Ku+MZfJhdt:41iewlqB6pbj4qf4MVzQo6SqJhUO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1932	1964	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1932	1964	SKM_C3350191107102.exe	28
PID 1964 wrote to memory of 1932	1964	SKM_C3350191107102.exe	28
PID 1964 wrote to memory of 1932	1964	SKM_C3350191107102.exe	28
PID 1964 wrote to memory of 1932	1964	SKM_C3350191107102.exe	28

C:\Users\Admin\AppData\Local\Temp\SKM_C3350191107102.exe
"C:\Users\Admin\AppData\Local\Temp\SKM_C3350191107102.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 652
  2⤵
  - Program crash
  PID:1932

memory/1964-54-0x0000000000C50000-0x0000000000D1C000-memory.dmp

Filesize
816KB

Download
memory/1964-55-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Filesize
256KB

Download
memory/1964-56-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Filesize
256KB

Download