69f602b148675223f36ff4d77a55d9c2cd04003000f5d5e1b21b4c6c501be4ab

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 12:20

Target

15011a95eb442061c9789d559081a785.exe
Size

530KB
MD5

15011a95eb442061c9789d559081a785
SHA1

37380c3f3ab7c373acce50c31d4f8f621eeb90cc
SHA256

69f602b148675223f36ff4d77a55d9c2cd04003000f5d5e1b21b4c6c501be4ab
SHA512

28720568b0a16c86961e668221f51636e0c8bb6592088217f5b8d895c10bf6ec9a4ab46885c83a12b201a73cab250e22164ddc3c3d0838b402b747a219a61cbf
SSDEEP

12288:io2JVedYmkqGFHLiPkUPxvdkIOCAyEnfXOl778eD55jjgUh4ldPTk8aGN/B6KB6F:io2JVedYmkqGFHLiPkUPxvdkIOCAyEnY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2124	3020	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2124	3020	15011a95eb442061c9789d559081a785.exe	28
PID 3020 wrote to memory of 2124	3020	15011a95eb442061c9789d559081a785.exe	28
PID 3020 wrote to memory of 2124	3020	15011a95eb442061c9789d559081a785.exe	28
PID 3020 wrote to memory of 2124	3020	15011a95eb442061c9789d559081a785.exe	28

C:\Users\Admin\AppData\Local\Temp\15011a95eb442061c9789d559081a785.exe
"C:\Users\Admin\AppData\Local\Temp\15011a95eb442061c9789d559081a785.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 128
  2⤵
  - Program crash
  PID:2124