32e8e7993746e4abffc60a23a2ae723c08460be91c2557df68ad313114f6ab7a

Analysis

max time kernel
119s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 04:50

Target

67d07bc1a6b5925cc5e0e4885f066ed4.exe
Size

5KB
MD5

67d07bc1a6b5925cc5e0e4885f066ed4
SHA1

c30e863e9683de6ff057d5dfbc816cf9fb9d1945
SHA256

32e8e7993746e4abffc60a23a2ae723c08460be91c2557df68ad313114f6ab7a
SHA512

749d1786da24f504b6d58dbb216111f3e1f8e64599833532bcbd12fd8160067fca0d14c1b2ecb8f2b949dfa80b3c9bc4eee8c8f1f04627faa255b38fa1669098
SSDEEP

48:i3Aa9uvY6uVg0dJ88RZR4gwrLOP5MYGqJXESlo/tfpMd1Ru1FsWTNQRRhBK0l9hL:Sdr88RtwYMYGqblYFpMBgs1i/cwTg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2244	2472	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2244	2472	67d07bc1a6b5925cc5e0e4885f066ed4.exe	28
PID 2472 wrote to memory of 2244	2472	67d07bc1a6b5925cc5e0e4885f066ed4.exe	28
PID 2472 wrote to memory of 2244	2472	67d07bc1a6b5925cc5e0e4885f066ed4.exe	28
PID 2472 wrote to memory of 2244	2472	67d07bc1a6b5925cc5e0e4885f066ed4.exe	28

C:\Users\Admin\AppData\Local\Temp\67d07bc1a6b5925cc5e0e4885f066ed4.exe
"C:\Users\Admin\AppData\Local\Temp\67d07bc1a6b5925cc5e0e4885f066ed4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 68
  2⤵
  - Program crash
  PID:2244