5a64f780e04abc0bd21004cd6625e1d024af2a743de0e6feda65f47321cf3b52

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 17:03

Target

2f5033448789dca5bca9d9d7e591a662.exe
Size

336KB
MD5

2f5033448789dca5bca9d9d7e591a662
SHA1

ca3fa25005054f3439c1b9701ce3b222f6a712bc
SHA256

5a64f780e04abc0bd21004cd6625e1d024af2a743de0e6feda65f47321cf3b52
SHA512

b1b37cc7cb013b0da841ddfda568eb0babff4960dbf209548c259c3187656716ee55151a9d5a3742e390658b121225d6cd21938a6b89db5c9682720391561b35
SSDEEP

6144:VpfkmJ0OMZeSTLA6GNGxFIhAcEiS9VvvDc1B5CQPTYmusHCtrR2sD09C+A9B3p3:TkOIeSTU6GYo7ivnDc1JTYfsHCt9Z096

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2372	816	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 2372	816	2f5033448789dca5bca9d9d7e591a662.exe	16
PID 816 wrote to memory of 2372	816	2f5033448789dca5bca9d9d7e591a662.exe	16
PID 816 wrote to memory of 2372	816	2f5033448789dca5bca9d9d7e591a662.exe	16
PID 816 wrote to memory of 2372	816	2f5033448789dca5bca9d9d7e591a662.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 108
1⤵
- Program crash
PID:2372

C:\Users\Admin\AppData\Local\Temp\2f5033448789dca5bca9d9d7e591a662.exe
"C:\Users\Admin\AppData\Local\Temp\2f5033448789dca5bca9d9d7e591a662.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:816

memory/816-0-0x0000000000E90000-0x0000000000EBE000-memory.dmp

Filesize
184KB

Download
memory/816-1-0x0000000000E90000-0x0000000000EBE000-memory.dmp

Filesize
184KB

Download