5bf97dbd50c46590e2c09e1b408b46b1424864328db09dd42f56621bd6088686

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 17:39

Target

3194375acf9525b213c765cf51f91f57.exe
Size

292KB
MD5

3194375acf9525b213c765cf51f91f57
SHA1

e01e2c83c70145f091f2502aa200b2c88d01e4d9
SHA256

5bf97dbd50c46590e2c09e1b408b46b1424864328db09dd42f56621bd6088686
SHA512

a46ff58ddf458616795dbfd6250c71b1f90fad5819554fa3178e62bbd60424fb3a9c323d8274d0a181f5990e7a3d123bd8a5ae27862e5385caa954ddb437eca3
SSDEEP

3072:DRRLh60X2NtW3k+Jx2TcM1yQabYMkTgeLT+w2EC4j0oYb8e+jmbH7EMOjxxHr6xY:c0FkP1yQlTgALXqo1jmUZxL6xQGQgg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2928	2508	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2928	2508	3194375acf9525b213c765cf51f91f57.exe	16
PID 2508 wrote to memory of 2928	2508	3194375acf9525b213c765cf51f91f57.exe	16
PID 2508 wrote to memory of 2928	2508	3194375acf9525b213c765cf51f91f57.exe	16
PID 2508 wrote to memory of 2928	2508	3194375acf9525b213c765cf51f91f57.exe	16

C:\Users\Admin\AppData\Local\Temp\3194375acf9525b213c765cf51f91f57.exe
"C:\Users\Admin\AppData\Local\Temp\3194375acf9525b213c765cf51f91f57.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 164
  2⤵
  - Program crash
  PID:2928

memory/2508-0-0x0000000000400000-0x00000000005F5000-memory.dmp

Filesize
2.0MB

Download