3dc74e6df3273657cfaec5ef6730bc57cd69fbf2d84f91a2cfeffca062962940

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 22:22

Target

3fcd8493be255ab11f97a36fc7083d56.exe
Size

166KB
MD5

3fcd8493be255ab11f97a36fc7083d56
SHA1

dbdc07a3441f2f1503eb8a8f8c224a02e938afac
SHA256

3dc74e6df3273657cfaec5ef6730bc57cd69fbf2d84f91a2cfeffca062962940
SHA512

1496eb7e5465b0d2398fdce4528b2f353ddf7631f67cc5e557f66704908b5e3484cc575c5aefb6c34d12ddcee54e326394e580c7d405fd90e36c871aced4fefd
SSDEEP

3072:xxrgVdUajo/65qQM2Wcr/n2WEBCjr0PBXkXBmZlaBQ30Q4YHXQ826z:va3zGcrzEuG7aKkQ4m/z

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2836	2928	WerFault.exe	2

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2836	2928	3fcd8493be255ab11f97a36fc7083d56.exe	29
PID 2928 wrote to memory of 2836	2928	3fcd8493be255ab11f97a36fc7083d56.exe	29
PID 2928 wrote to memory of 2836	2928	3fcd8493be255ab11f97a36fc7083d56.exe	29
PID 2928 wrote to memory of 2836	2928	3fcd8493be255ab11f97a36fc7083d56.exe	29

C:\Users\Admin\AppData\Local\Temp\3fcd8493be255ab11f97a36fc7083d56.exe
"C:\Users\Admin\AppData\Local\Temp\3fcd8493be255ab11f97a36fc7083d56.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 148
  2⤵
  - Program crash
  PID:2836