39a61cafd529a364315f5f431c13211a76f3ec31ca960d9b36e7977ec45404fe

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 18:40

Target

0ca516a9fc4530c4e919787f7f805c03.exe
Size

185KB
MD5

0ca516a9fc4530c4e919787f7f805c03
SHA1

02307658dff7d2cf8aaf7e6775c51c50ab161036
SHA256

39a61cafd529a364315f5f431c13211a76f3ec31ca960d9b36e7977ec45404fe
SHA512

008567175857b2066c6d1f577bf23c61990142a54dd04ca941ef6870ae32d561e2cb8018b1e22a1788661ce967c3a6f653b5ff085c6fd0e93ad8048f260980c0
SSDEEP

3072:AkblbLdo0DH+fKdp5Hy6a0z6q0fePj2lKY3fsntI0r6ltksBZR:dbLdo0DH+idp5S6a0OfQjPG0n6csBZR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2692	3036	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2692	3036	0ca516a9fc4530c4e919787f7f805c03.exe	27
PID 3036 wrote to memory of 2692	3036	0ca516a9fc4530c4e919787f7f805c03.exe	27
PID 3036 wrote to memory of 2692	3036	0ca516a9fc4530c4e919787f7f805c03.exe	27
PID 3036 wrote to memory of 2692	3036	0ca516a9fc4530c4e919787f7f805c03.exe	27

C:\Users\Admin\AppData\Local\Temp\0ca516a9fc4530c4e919787f7f805c03.exe
"C:\Users\Admin\AppData\Local\Temp\0ca516a9fc4530c4e919787f7f805c03.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 140
  2⤵
  - Program crash
  PID:2692

memory/3036-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download