39df31b0a989a0407f86afd79bc11ea8a339379d01e8b6cbb26bd2e74086d88c

Analysis

max time kernel
122s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 21:41

Target

3e05cf2b7b463a51a046d6d5ee756162.exe
Size

63KB
MD5

3e05cf2b7b463a51a046d6d5ee756162
SHA1

c23bc6522aeab5061e63ce36980276329c77dc4c
SHA256

39df31b0a989a0407f86afd79bc11ea8a339379d01e8b6cbb26bd2e74086d88c
SHA512

af02b0bb0d5f452d97ad1e41ddd6e5217e4c040f38166a43a4a52bf6e1dbbe05815cd1f0d5a1e1ec6ec85b50847035f2646b08ec4d27bcc640aab6bc55fa1a31
SSDEEP

1536:YiKx1YGRNSUlTwqQo7uBBE+yRSvoeqkv1Y8ZLP28Bw0SsF1IqI7AoKDXH28:YiKx1YGRNS1qiEbyxRPby6oqeAoKD3N

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2928	2812	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 2928	2812	3e05cf2b7b463a51a046d6d5ee756162.exe	29
PID 2812 wrote to memory of 2928	2812	3e05cf2b7b463a51a046d6d5ee756162.exe	29
PID 2812 wrote to memory of 2928	2812	3e05cf2b7b463a51a046d6d5ee756162.exe	29
PID 2812 wrote to memory of 2928	2812	3e05cf2b7b463a51a046d6d5ee756162.exe	29

C:\Users\Admin\AppData\Local\Temp\3e05cf2b7b463a51a046d6d5ee756162.exe
"C:\Users\Admin\AppData\Local\Temp\3e05cf2b7b463a51a046d6d5ee756162.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 36
  2⤵
  - Program crash
  PID:2928

memory/2812-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2812-1-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download