e7d51cd5a5daedd7ff9c79aa9a20145458666719954fb4b474639a6113e394ec

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 19:28

Target

37f2e6019466e8bfe724613b75c85278.exe
Size

102KB
MD5

37f2e6019466e8bfe724613b75c85278
SHA1

6084aee3803082636f3297bc7c244bc830b2f5d0
SHA256

e7d51cd5a5daedd7ff9c79aa9a20145458666719954fb4b474639a6113e394ec
SHA512

badebaceb6b9694ac0ef748b4254a89c4059eaa76445e23364685bb772fd59c7586114bffb6433ec6116df09d1ce34e28660ee04216d62ddf384b7d65c4af74e
SSDEEP

1536:rSLwfCBlHt5eOFWkeiJuQnnKS7KM+YLmaWYgb3pO3j72u9aU5hxG1uue2zuhYCgX:rZ4t5wXivKSNv9grI7d9C3zuhYCI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3016	2808	WerFault.exe	12

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 3016	2808	37f2e6019466e8bfe724613b75c85278.exe	28
PID 2808 wrote to memory of 3016	2808	37f2e6019466e8bfe724613b75c85278.exe	28
PID 2808 wrote to memory of 3016	2808	37f2e6019466e8bfe724613b75c85278.exe	28
PID 2808 wrote to memory of 3016	2808	37f2e6019466e8bfe724613b75c85278.exe	28

C:\Users\Admin\AppData\Local\Temp\37f2e6019466e8bfe724613b75c85278.exe
"C:\Users\Admin\AppData\Local\Temp\37f2e6019466e8bfe724613b75c85278.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 36
  2⤵
  - Program crash
  PID:3016

memory/2808-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download