5f649def718c15e4d440c45617195f2bddf667f0bf8a7747693a872c1e876d65

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 18:26

Target

346f2a207c39a81489c1902229cab75c.exe
Size

64KB
MD5

346f2a207c39a81489c1902229cab75c
SHA1

a7658be38451f1c8c85e925b62fa762890cdcaa4
SHA256

5f649def718c15e4d440c45617195f2bddf667f0bf8a7747693a872c1e876d65
SHA512

626a77864bf3c77913ea3f6614af8fc331919df8c5528b09e82f0ed6845f8538bbe387b6dc11aed3c77222ba5cae3679a0df1ca19660cd284fa7f2dbc6908616
SSDEEP

1536:OudQailKET1c8TG1mS5nQzeZzLqNVH09D8EAOjgj7KS:zQailr5fTG1mSUgza09D8EC1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2600	1204	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 2600	1204	346f2a207c39a81489c1902229cab75c.exe	28
PID 1204 wrote to memory of 2600	1204	346f2a207c39a81489c1902229cab75c.exe	28
PID 1204 wrote to memory of 2600	1204	346f2a207c39a81489c1902229cab75c.exe	28
PID 1204 wrote to memory of 2600	1204	346f2a207c39a81489c1902229cab75c.exe	28

C:\Users\Admin\AppData\Local\Temp\346f2a207c39a81489c1902229cab75c.exe
"C:\Users\Admin\AppData\Local\Temp\346f2a207c39a81489c1902229cab75c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 288
  2⤵
  - Program crash
  PID:2600

memory/1204-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1204-1-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download