3e28a79cc39b7cd752a3421e2ab864ed77e4dbc6c3c708688310cd6d627e920d

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 21:50

Target

13d28ea3c49fa93fa71375cd1ded9c52.exe
Size

105KB
MD5

13d28ea3c49fa93fa71375cd1ded9c52
SHA1

1ca7798e364288bdafbd3dc27cf6a67e381b8208
SHA256

3e28a79cc39b7cd752a3421e2ab864ed77e4dbc6c3c708688310cd6d627e920d
SHA512

91ea6ffde7cae4fe514214a7a0b6122c3bdbbf111c070e7198d4fced3a70e4dac7e81d43472911a3468883e692c6d8d0a5c49462dbb3732b86c0f5cbbc049e2b
SSDEEP

1536:zBlRon8JZKXZGYhISdWRDA0ksJKDFixL7rc6MhaGPf2:ZGkaFI0Wpkswi5Pc6IaAf2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2548	1888	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2548	1888	13d28ea3c49fa93fa71375cd1ded9c52.exe	28
PID 1888 wrote to memory of 2548	1888	13d28ea3c49fa93fa71375cd1ded9c52.exe	28
PID 1888 wrote to memory of 2548	1888	13d28ea3c49fa93fa71375cd1ded9c52.exe	28
PID 1888 wrote to memory of 2548	1888	13d28ea3c49fa93fa71375cd1ded9c52.exe	28

C:\Users\Admin\AppData\Local\Temp\13d28ea3c49fa93fa71375cd1ded9c52.exe
"C:\Users\Admin\AppData\Local\Temp\13d28ea3c49fa93fa71375cd1ded9c52.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 116
  2⤵
  - Program crash
  PID:2548

memory/1888-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download