5fb512be0e33b9d8ea3e58b1763274acebf729f8dcb5a345c9d9a020ce7f39d9

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 14:28

Target

00df520ef96a89b7d7a16a502c0f73e4.exe
Size

23KB
MD5

00df520ef96a89b7d7a16a502c0f73e4
SHA1

e0c2d2e095c18262391adc19b20909db0b3eaadd
SHA256

5fb512be0e33b9d8ea3e58b1763274acebf729f8dcb5a345c9d9a020ce7f39d9
SHA512

1e1b13668d91450b95b4db461791811826e1cd20d758d6be9ef14828ff9a4fffa1f545210fde2c92bc45e35837609ee1d3cfed07221ef5f8d57de49e4c8393b9
SSDEEP

192:Vq9G6DCNbk3fU81Mk+m7phNo+o1Ms21aErvfBGVeINh3qfDPRRRRRRRRRRRRRRRG:VqPClcUm+k3U21NrQeqOiwYjt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
624	1728	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 624	1728	00df520ef96a89b7d7a16a502c0f73e4.exe	16
PID 1728 wrote to memory of 624	1728	00df520ef96a89b7d7a16a502c0f73e4.exe	16
PID 1728 wrote to memory of 624	1728	00df520ef96a89b7d7a16a502c0f73e4.exe	16
PID 1728 wrote to memory of 624	1728	00df520ef96a89b7d7a16a502c0f73e4.exe	16

C:\Users\Admin\AppData\Local\Temp\00df520ef96a89b7d7a16a502c0f73e4.exe
"C:\Users\Admin\AppData\Local\Temp\00df520ef96a89b7d7a16a502c0f73e4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 92
  2⤵
  - Program crash
  PID:624