1e35fb886e2dece9ca906c0c6683a1720ae8057585dad7d8ed8800c65b2f6325

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 01:33

Target

5c8c01c5952b69b6952973d6add9c461.exe
Size

3.7MB
MD5

5c8c01c5952b69b6952973d6add9c461
SHA1

7984880ee73f6b131cf8ffc6aacbbb795fbf2bb8
SHA256

1e35fb886e2dece9ca906c0c6683a1720ae8057585dad7d8ed8800c65b2f6325
SHA512

fe4152368d3723dc9a0bb228b69d32cdff24fc8a4cfdf05c6fe13d5ec084b0c2f2c5b9e9ad578e3463a85f4a75e3977b13b7c3aa16b2b087375be5ecd55a58c4
SSDEEP

24576:IDVjf1SK0QuhEhfvHhO7fN9zFj5XDERLldbMfn/5LSARfcOMb+JGPSkHZRyYc6IK:IxjfP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2184	1336	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2184	1336	5c8c01c5952b69b6952973d6add9c461.exe	28
PID 1336 wrote to memory of 2184	1336	5c8c01c5952b69b6952973d6add9c461.exe	28
PID 1336 wrote to memory of 2184	1336	5c8c01c5952b69b6952973d6add9c461.exe	28
PID 1336 wrote to memory of 2184	1336	5c8c01c5952b69b6952973d6add9c461.exe	28

C:\Users\Admin\AppData\Local\Temp\5c8c01c5952b69b6952973d6add9c461.exe
"C:\Users\Admin\AppData\Local\Temp\5c8c01c5952b69b6952973d6add9c461.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 36
  2⤵
  - Program crash
  PID:2184

memory/1336-0-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download