dafdf184709752662738808bfba5b53bfc28436e144688179c0bc52a40c0a3a2

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
15-07-2023 14:29

Target

5384d18e4d08f1exeexe_JC.exe
Size

851KB
MD5

5384d18e4d08f1ea8a1d6e323c852cff
SHA1

1a92ec5279d769348927e9d4adf80ea627fe3117
SHA256

dafdf184709752662738808bfba5b53bfc28436e144688179c0bc52a40c0a3a2
SHA512

28cdb0e57018050f8d102d4a5babaf4dcaf019fc467aa3dae2fb486a03d7061217a432fa528afc1d52a80c9aa80348f43896a3b292a6c2cf16b15819eeeada20
SSDEEP

12288:SaVt0m8mQvhGLYAcAf7PKsNz9MKuajV5qISm2bmz4O/EAhOFNTlhncGn6jsC7V7E:Sa4Ac7hQ/Efnl/n6AaIZB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2624	1656	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2624	1656	5384d18e4d08f1exeexe_JC.exe	28
PID 1656 wrote to memory of 2624	1656	5384d18e4d08f1exeexe_JC.exe	28
PID 1656 wrote to memory of 2624	1656	5384d18e4d08f1exeexe_JC.exe	28
PID 1656 wrote to memory of 2624	1656	5384d18e4d08f1exeexe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\5384d18e4d08f1exeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\5384d18e4d08f1exeexe_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 152
  2⤵
  - Program crash
  PID:2624