33d34849f37b13edb8edc15c894973cecf4589890ff5f5cca99ae8a9e646cc34

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 19:53

Target

0efea478f54d341424106e290b0e70a6.exe
Size

3.4MB
MD5

0efea478f54d341424106e290b0e70a6
SHA1

82196f0e2ad9d0ed55579f965eeee5385b52a972
SHA256

33d34849f37b13edb8edc15c894973cecf4589890ff5f5cca99ae8a9e646cc34
SHA512

c544d3f7cffa7f917954fa297357c4391966eb338df7a037283ce9205af1fac734f8423758480739d8d4595c0e11919f750792ea3e712f5e54ecb949d8ab3605
SSDEEP

98304:5gSreyKFCHoFiAaNduHAmq7AskNzU1nqVtv8PL7:5gSreyKFCHoFiAaNduHAmq7DkNA1nqVe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1984	2172	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 1984	2172	0efea478f54d341424106e290b0e70a6.exe	28
PID 2172 wrote to memory of 1984	2172	0efea478f54d341424106e290b0e70a6.exe	28
PID 2172 wrote to memory of 1984	2172	0efea478f54d341424106e290b0e70a6.exe	28
PID 2172 wrote to memory of 1984	2172	0efea478f54d341424106e290b0e70a6.exe	28

C:\Users\Admin\AppData\Local\Temp\0efea478f54d341424106e290b0e70a6.exe
"C:\Users\Admin\AppData\Local\Temp\0efea478f54d341424106e290b0e70a6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 148
  2⤵
  - Program crash
  PID:1984