5cefbdacaa9c84d72ebde7382d23c7e88de30baf326c4b358024633100d86141

Analysis

max time kernel
119s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 01:24

Target

204344d7e3f66afc5efe7243ba7cde32.exe
Size

367KB
MD5

204344d7e3f66afc5efe7243ba7cde32
SHA1

39816b4369cc294f6509a23f74e801f84b1a62ab
SHA256

5cefbdacaa9c84d72ebde7382d23c7e88de30baf326c4b358024633100d86141
SHA512

5fb46e41822c63a8b99dccb3d298a73deb52135ff03cbe3bb2c411f1e9a369e9ec1471deadb5fa60f8b4f7c690fc8058792b444ce4c8caf08814a50bcbb28a1e
SSDEEP

6144:rpEcAd/Mm5ZkyUneRTnJOmQ4W4/6zA5K0TzJRCp4xRvKUllD/W13+Y:rTAOm5eyUnJmCzAXTzJR3RvK6lCwY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2480	2508	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2480	2508	204344d7e3f66afc5efe7243ba7cde32.exe	14
PID 2508 wrote to memory of 2480	2508	204344d7e3f66afc5efe7243ba7cde32.exe	14
PID 2508 wrote to memory of 2480	2508	204344d7e3f66afc5efe7243ba7cde32.exe	14
PID 2508 wrote to memory of 2480	2508	204344d7e3f66afc5efe7243ba7cde32.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 116
1⤵
- Program crash
PID:2480

C:\Users\Admin\AppData\Local\Temp\204344d7e3f66afc5efe7243ba7cde32.exe
"C:\Users\Admin\AppData\Local\Temp\204344d7e3f66afc5efe7243ba7cde32.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508

memory/2508-0-0x0000000000380000-0x00000000003E0000-memory.dmp

Filesize
384KB

Download