94e03e068f2942547b0dddeece8cfd2b36ec8dfb082d389898de1fd228cfa656

Analysis

max time kernel
119s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 17:54

Target

3274953c6f01a16c9f5e2556837e4e6c.exe
Size

417KB
MD5

3274953c6f01a16c9f5e2556837e4e6c
SHA1

5618c6ca8d831500bcb4cbb3e49b71954edac3e7
SHA256

94e03e068f2942547b0dddeece8cfd2b36ec8dfb082d389898de1fd228cfa656
SHA512

71e9a5df08db18c23678f0aea30ad4c83b881199bfbf6233198ea6a22bcc31cb3b9b9527a2048a72d67b7b975f16a0a48a0b08a99fed0041b98b16c25f247c8a
SSDEEP

12288:y/w6fh7DeX82M7/I+9jr/sJvs49nxUlMS:p6fh7SpY99jLsJU4IlMS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2632	2044	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2632	2044	3274953c6f01a16c9f5e2556837e4e6c.exe	28
PID 2044 wrote to memory of 2632	2044	3274953c6f01a16c9f5e2556837e4e6c.exe	28
PID 2044 wrote to memory of 2632	2044	3274953c6f01a16c9f5e2556837e4e6c.exe	28
PID 2044 wrote to memory of 2632	2044	3274953c6f01a16c9f5e2556837e4e6c.exe	28

C:\Users\Admin\AppData\Local\Temp\3274953c6f01a16c9f5e2556837e4e6c.exe
"C:\Users\Admin\AppData\Local\Temp\3274953c6f01a16c9f5e2556837e4e6c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 96
  2⤵
  - Program crash
  PID:2632

memory/2044-0-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/2044-2-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2044-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2044-3-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/2044-4-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download