79ece71af3d10e52c494015fa7afb9b21eb44b819b377e9c7c7a86df1e095371

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 04:39

Target

05a0d1f8f54892cb557c294751724ffb.exe
Size

704KB
MD5

05a0d1f8f54892cb557c294751724ffb
SHA1

08871cdc0e3638cf5857f89b1268878fb474f546
SHA256

79ece71af3d10e52c494015fa7afb9b21eb44b819b377e9c7c7a86df1e095371
SHA512

453c38afa5b3d4388eb0ca8cd2cd4cb01bb67e295ad472a5439aab661a2935342c829ac7687ac89e4fa6866bebaf8d09bb759c3300a2996c3c3222d4ce25a952
SSDEEP

6144:b6ajyiWz7KXsS5Z5zrTiacQiRcUEg2zeiuNUkWRzt2A0nhMQ//:njyfHShPcLRMgPUki90h1//

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3048	2004	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 3048	2004	05a0d1f8f54892cb557c294751724ffb.exe	16
PID 2004 wrote to memory of 3048	2004	05a0d1f8f54892cb557c294751724ffb.exe	16
PID 2004 wrote to memory of 3048	2004	05a0d1f8f54892cb557c294751724ffb.exe	16
PID 2004 wrote to memory of 3048	2004	05a0d1f8f54892cb557c294751724ffb.exe	16

C:\Users\Admin\AppData\Local\Temp\05a0d1f8f54892cb557c294751724ffb.exe
"C:\Users\Admin\AppData\Local\Temp\05a0d1f8f54892cb557c294751724ffb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 148
  2⤵
  - Program crash
  PID:3048