5b178bc45d65a8e87b7d09f17c98f206a425d2ce3c26cb4b035a823f9f9bd1e8

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 18:16

Target

33d5361dfc0d897a686ec03dba67f846.exe
Size

32KB
MD5

33d5361dfc0d897a686ec03dba67f846
SHA1

55785a96b312226403d2e92501623bba5f88b6e4
SHA256

5b178bc45d65a8e87b7d09f17c98f206a425d2ce3c26cb4b035a823f9f9bd1e8
SHA512

5953be0a60e4579da4c537db125611ac17ec8972fdb67b5eac9f5961829a3f65bfdb7f5b4258a619a49cc4d47f1764fec3517838f378555b519f2eeb78d06d54
SSDEEP

192:VU80bgx/nJgf5OnGi0NDdxlAQqGHXJnpPQEkVJcwS4YLWK:VJ/xRFnGNhxSQVpqzg4GW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2884	1764	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 2884	1764	33d5361dfc0d897a686ec03dba67f846.exe	28
PID 1764 wrote to memory of 2884	1764	33d5361dfc0d897a686ec03dba67f846.exe	28
PID 1764 wrote to memory of 2884	1764	33d5361dfc0d897a686ec03dba67f846.exe	28
PID 1764 wrote to memory of 2884	1764	33d5361dfc0d897a686ec03dba67f846.exe	28

C:\Users\Admin\AppData\Local\Temp\33d5361dfc0d897a686ec03dba67f846.exe
"C:\Users\Admin\AppData\Local\Temp\33d5361dfc0d897a686ec03dba67f846.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 88
  2⤵
  - Program crash
  PID:2884

memory/1764-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download