32e39762d78f59376489e145dd90f4d580dbb502eb9e5fb114b1ff6b0005bbf3

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 01:09

Target

1f5a8012718dac5de6f7404a47a60bed.exe
Size

367KB
MD5

1f5a8012718dac5de6f7404a47a60bed
SHA1

a1be892ecbd03e0fce71e40b4aae3997cbf0033b
SHA256

32e39762d78f59376489e145dd90f4d580dbb502eb9e5fb114b1ff6b0005bbf3
SHA512

0add5820f787f7e73bd6a1c30a4dc9ad48db138e7af41d411f61819c8ec1e0f7c843e2e11ba5f54bb04d2a24e0bce3cd7213f25ab032ef94bac1f9ddcdf50dc3
SSDEEP

6144:rpEcAd/Mm5ZkyUneRTnJOmQ4W4/6zA5K0TzJRCp4xRvKUllD/W13+Z:rTAOm5eyUnJmCzAXTzJR3RvK6lCwZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1108	1204	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1108	1204	1f5a8012718dac5de6f7404a47a60bed.exe	28
PID 1204 wrote to memory of 1108	1204	1f5a8012718dac5de6f7404a47a60bed.exe	28
PID 1204 wrote to memory of 1108	1204	1f5a8012718dac5de6f7404a47a60bed.exe	28
PID 1204 wrote to memory of 1108	1204	1f5a8012718dac5de6f7404a47a60bed.exe	28

C:\Users\Admin\AppData\Local\Temp\1f5a8012718dac5de6f7404a47a60bed.exe
"C:\Users\Admin\AppData\Local\Temp\1f5a8012718dac5de6f7404a47a60bed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 116
  2⤵
  - Program crash
  PID:1108

memory/1204-0-0x0000000001360000-0x00000000013C0000-memory.dmp

Filesize
384KB

Download