5fa284bd671adab9d61e8306d00b84ed08a5eff684f6d71cf49c2a04e214fe73

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 14:57

Target

028d4d8ef8e1cec771f7115ad81d5eb8.exe
Size

296KB
MD5

028d4d8ef8e1cec771f7115ad81d5eb8
SHA1

9bd7d26e74d53a54278914a883d1334ae8b51bea
SHA256

5fa284bd671adab9d61e8306d00b84ed08a5eff684f6d71cf49c2a04e214fe73
SHA512

b433098722b764374c759a238a978ce22c6352721342033c2afb33618d140374c6ab9b86202ceb20f33140a091018ebccb9a14d7e84edb6cd644e323f7098f3a
SSDEEP

6144:O2S2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:pS2EB0NxDIBuOFe7/uT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2324	1684	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2324	1684	028d4d8ef8e1cec771f7115ad81d5eb8.exe	28
PID 1684 wrote to memory of 2324	1684	028d4d8ef8e1cec771f7115ad81d5eb8.exe	28
PID 1684 wrote to memory of 2324	1684	028d4d8ef8e1cec771f7115ad81d5eb8.exe	28
PID 1684 wrote to memory of 2324	1684	028d4d8ef8e1cec771f7115ad81d5eb8.exe	28

C:\Users\Admin\AppData\Local\Temp\028d4d8ef8e1cec771f7115ad81d5eb8.exe
"C:\Users\Admin\AppData\Local\Temp\028d4d8ef8e1cec771f7115ad81d5eb8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 148
  2⤵
  - Program crash
  PID:2324

memory/1684-1-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download