c5f82b52a651846d9c6d8e86de9ced55e0821bad05acc967a0f9478e3a771ecd

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19/08/2023, 13:40

Target

418e966a9f002fcb8319062096335977_stop_JC.exe
Size

1.1MB
MD5

418e966a9f002fcb8319062096335977
SHA1

9f2d1bb6a97e926690fe55dcb9e379fda42b5345
SHA256

c5f82b52a651846d9c6d8e86de9ced55e0821bad05acc967a0f9478e3a771ecd
SHA512

13c5ceb1805bdc40086b752646e81f9640f39f9819e2af6f8c3383b8a081cddc2dea67ba798c7e2bb59a8b1f165244ad325456197f5d1193503ccd6baef72c56
SSDEEP

24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/XRPOO82dHUq7:F0dwAYZt6C31WeTPRPOh2BUq7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2468	2312	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2468	2312	418e966a9f002fcb8319062096335977_stop_JC.exe	28
PID 2312 wrote to memory of 2468	2312	418e966a9f002fcb8319062096335977_stop_JC.exe	28
PID 2312 wrote to memory of 2468	2312	418e966a9f002fcb8319062096335977_stop_JC.exe	28
PID 2312 wrote to memory of 2468	2312	418e966a9f002fcb8319062096335977_stop_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\418e966a9f002fcb8319062096335977_stop_JC.exe
"C:\Users\Admin\AppData\Local\Temp\418e966a9f002fcb8319062096335977_stop_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 192
  2⤵
  - Program crash
  PID:2468