0023418a6dc4dcac4130b0fb9333851f4763a04238ad0559c6e2e675e384476e

Analysis

max time kernel
118s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:32

Target

0349f837e926d5295e39673053a2a36b.exe
Size

1023KB
MD5

0349f837e926d5295e39673053a2a36b
SHA1

5bea43a8bef3982da77f3ec19cda4d6d945e2c5a
SHA256

0023418a6dc4dcac4130b0fb9333851f4763a04238ad0559c6e2e675e384476e
SHA512

9fa10a1fc11acb0ee791922d7d0cecd1514b8366d2eea12c2a04bcc04a9bc4a17672ac3dde421c69db6bc3e116a583501be823511caaec1700da120a33b5ce94
SSDEEP

24576:Y8yeBUjG6IaGJ6x/lHehwsN4fNBGOLtbp8Yj0Sxp:Y+Ui6ABhlKBGctbp8tSxp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2796	2768	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2796	2768	0349f837e926d5295e39673053a2a36b.exe	29
PID 2768 wrote to memory of 2796	2768	0349f837e926d5295e39673053a2a36b.exe	29
PID 2768 wrote to memory of 2796	2768	0349f837e926d5295e39673053a2a36b.exe	29
PID 2768 wrote to memory of 2796	2768	0349f837e926d5295e39673053a2a36b.exe	29

C:\Users\Admin\AppData\Local\Temp\0349f837e926d5295e39673053a2a36b.exe
"C:\Users\Admin\AppData\Local\Temp\0349f837e926d5295e39673053a2a36b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 88
  2⤵
  - Program crash
  PID:2796