6502b8ea9e90791c916c72a994cc9e056f76dafbd1ef255ce8ba6532464c5ecd

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09/06/2023, 08:17

Target

SKM_C3350191107102.exe
Size

787KB
MD5

a5ce45801e46960f6e7e0f76da9a6911
SHA1

44d90f01098d734c3e5549a0522bb752e686fdd0
SHA256

73133d85eddbea96f9281bf37d91fe0dc40bf9202df3133d74b0bcccde48a2aa
SHA512

4efb8f216abcfb116c160e97866279c3d224d327bd9913fbf27ed253764e6b7738e56c4a48362bb4dd68e03b89e44055ba4dc25fbf2d6232ee757c8128d39430
SSDEEP

12288:42iNUewx/NscEQ+vgXK1HsaSj4qfS1t/YxwSWpqQu250Qvj7K1hDZ6Ku+MZfJhdt:41iewlqB6pbj4qf4MVzQo6SqJhUO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
908	1536	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 908	1536	SKM_C3350191107102.exe	28
PID 1536 wrote to memory of 908	1536	SKM_C3350191107102.exe	28
PID 1536 wrote to memory of 908	1536	SKM_C3350191107102.exe	28
PID 1536 wrote to memory of 908	1536	SKM_C3350191107102.exe	28

C:\Users\Admin\AppData\Local\Temp\SKM_C3350191107102.exe
"C:\Users\Admin\AppData\Local\Temp\SKM_C3350191107102.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 652
  2⤵
  - Program crash
  PID:908

memory/1536-54-0x0000000000380000-0x000000000044C000-memory.dmp

Filesize
816KB

Download
memory/1536-55-0x0000000004D60000-0x0000000004DA0000-memory.dmp

Filesize
256KB

Download
memory/1536-56-0x0000000004D60000-0x0000000004DA0000-memory.dmp

Filesize
256KB

Download