64317dcbed22c946db3987f582db9b783032a2b2218a63bbceea863c3a34db06

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
26/11/2023, 16:57

Target

64317dcbed22c946db3987f582db9b783032a2b2218a63bbceea863c3a34db06.exe
Size

5KB
MD5

074c53c97b5aaad5118c448889c5fe38
SHA1

931f5d8c2601f0345f43dbb6e2c703776b5f9fb5
SHA256

64317dcbed22c946db3987f582db9b783032a2b2218a63bbceea863c3a34db06
SHA512

4747fc2fc0b1554deaff5118d6558c1e33efada40c7d6c6435e0ab4fe2923435a08a815bdc1d53487af95ef5a64b5ed900732797bb4d9d9daef7e5a745359b55
SSDEEP

48:SjlXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7tCRuqSxp:wWLkFfNnOKYloIQ2pm2pbYSOxE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2516	1988	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2516	1988	64317dcbed22c946db3987f582db9b783032a2b2218a63bbceea863c3a34db06.exe	28
PID 1988 wrote to memory of 2516	1988	64317dcbed22c946db3987f582db9b783032a2b2218a63bbceea863c3a34db06.exe	28
PID 1988 wrote to memory of 2516	1988	64317dcbed22c946db3987f582db9b783032a2b2218a63bbceea863c3a34db06.exe	28
PID 1988 wrote to memory of 2516	1988	64317dcbed22c946db3987f582db9b783032a2b2218a63bbceea863c3a34db06.exe	28

C:\Users\Admin\AppData\Local\Temp\64317dcbed22c946db3987f582db9b783032a2b2218a63bbceea863c3a34db06.exe
"C:\Users\Admin\AppData\Local\Temp\64317dcbed22c946db3987f582db9b783032a2b2218a63bbceea863c3a34db06.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 48
  2⤵
  - Program crash
  PID:2516