35f59125e15ae932cae16ead7ca77a2c33c3b1ab94cc7bb16897b05f0e1936c9

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 16:48

Target

0693cc65b96c7c09da827dcf1422cc64.exe
Size

76KB
MD5

0693cc65b96c7c09da827dcf1422cc64
SHA1

45cc682e88e7a7df03429ed66a279254e82ca312
SHA256

35f59125e15ae932cae16ead7ca77a2c33c3b1ab94cc7bb16897b05f0e1936c9
SHA512

f46058fd4fe05bc24cec9e27c01c5692169abaedfc34d83e98e130240645f1e2b72b1443b48e9051ba9bd4b64b7afe340554f27c7e8820e694057be571b87b6b
SSDEEP

1536:3XXXHy+hXJY4psDCs4nWf8rat4MycQACy63hmdAKeBXNZBpjVrs2ryrd1vUQuq6:3XXXS+hXJY4pyCs4nWCajydAYRo/sHso

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2408	2372	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2408	2372	0693cc65b96c7c09da827dcf1422cc64.exe	28
PID 2372 wrote to memory of 2408	2372	0693cc65b96c7c09da827dcf1422cc64.exe	28
PID 2372 wrote to memory of 2408	2372	0693cc65b96c7c09da827dcf1422cc64.exe	28
PID 2372 wrote to memory of 2408	2372	0693cc65b96c7c09da827dcf1422cc64.exe	28

C:\Users\Admin\AppData\Local\Temp\0693cc65b96c7c09da827dcf1422cc64.exe
"C:\Users\Admin\AppData\Local\Temp\0693cc65b96c7c09da827dcf1422cc64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 36
  2⤵
  - Program crash
  PID:2408

memory/2372-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download