b485fa2e40bdb6b3ae303af32f251dc3f53f2cc8edf4077f3634428342ef3585

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:37

Target

038123f8b5b8d4a8df5423012574b740.exe
Size

422KB
MD5

038123f8b5b8d4a8df5423012574b740
SHA1

078a4a9cca2a08eebc9c549647750c596636401e
SHA256

b485fa2e40bdb6b3ae303af32f251dc3f53f2cc8edf4077f3634428342ef3585
SHA512

498e3b6c828f6b7214bc77862fd9da0cfb4962a7ea6956595ead3386dcc948b6b816be3caa016ae1f6840ab27c73fece50d3c431e1c13b22e516cac58c42afae
SSDEEP

6144:ykB1INZdWaFzaE7mDGg7Y4+MFyBPys80G5sEOi9Ri9na5UVx3:ykBgdW/E7mDGg8xMkBp80GiZa5UVh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2272	1368	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2272	1368	038123f8b5b8d4a8df5423012574b740.exe	28
PID 1368 wrote to memory of 2272	1368	038123f8b5b8d4a8df5423012574b740.exe	28
PID 1368 wrote to memory of 2272	1368	038123f8b5b8d4a8df5423012574b740.exe	28
PID 1368 wrote to memory of 2272	1368	038123f8b5b8d4a8df5423012574b740.exe	28

C:\Users\Admin\AppData\Local\Temp\038123f8b5b8d4a8df5423012574b740.exe
"C:\Users\Admin\AppData\Local\Temp\038123f8b5b8d4a8df5423012574b740.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 116
  2⤵
  - Program crash
  PID:2272

memory/1368-0-0x0000000000DD0000-0x0000000000E3E000-memory.dmp

Filesize
440KB

Download