5bd3709662923af42f4199c00b67cbf9470d0f61b1250d2db87880a0805d5890

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 05:48

Target

0935ef8d8e5e8a0dfb2e92c4e706bf34.exe
Size

92KB
MD5

0935ef8d8e5e8a0dfb2e92c4e706bf34
SHA1

1e4737d7e6b24bc266653e803ca6d5d0f2f31333
SHA256

5bd3709662923af42f4199c00b67cbf9470d0f61b1250d2db87880a0805d5890
SHA512

3accda119515bae73b7c9cf47a18f9f821ef20e1ec972b24172f7d00766d3adc80ab9afdede37b4a25255542ccd69c89799d528c0cb425a6eaf137a99a109330
SSDEEP

768:ZWsw7HPGiVRLpBj3PbnsfC/uLBVSEFFoHa/ZU7rlvYbZyBtMpofeNv:WeaUFFoH6m7ribZCtC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2868	2872	WerFault.exe	10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2868	2872	0935ef8d8e5e8a0dfb2e92c4e706bf34.exe	28
PID 2872 wrote to memory of 2868	2872	0935ef8d8e5e8a0dfb2e92c4e706bf34.exe	28
PID 2872 wrote to memory of 2868	2872	0935ef8d8e5e8a0dfb2e92c4e706bf34.exe	28
PID 2872 wrote to memory of 2868	2872	0935ef8d8e5e8a0dfb2e92c4e706bf34.exe	28

C:\Users\Admin\AppData\Local\Temp\0935ef8d8e5e8a0dfb2e92c4e706bf34.exe
"C:\Users\Admin\AppData\Local\Temp\0935ef8d8e5e8a0dfb2e92c4e706bf34.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 148
  2⤵
  - Program crash
  PID:2868

memory/2872-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download