f8cd8463ec725223dda0f9e39b94485f656a795b85ce4662f4c0c7328a88d6c5

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 19:04

Target

36859d69bc504dea453f69c84e10094f.exe
Size

83KB
MD5

36859d69bc504dea453f69c84e10094f
SHA1

7d8e6f8e189ebdae96751826a50a5e13510fc6ad
SHA256

f8cd8463ec725223dda0f9e39b94485f656a795b85ce4662f4c0c7328a88d6c5
SHA512

56e5536c385a4542712add84050ba41f50cd8e481e9f4f199fb25d908aa3ea9191b5dc9a2c4add104c6c24c81ce3e9ba58923ec2aa14239045580de025e17281
SSDEEP

1536:g7Dwfiqc1u/0pYvO7Koinj7b1/UpcweODom4piyUo/FVG4k:g7Dwfiqn/eYvogjfeGnOBUiy/FVG4k

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3012	2600	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 3012	2600	36859d69bc504dea453f69c84e10094f.exe	28
PID 2600 wrote to memory of 3012	2600	36859d69bc504dea453f69c84e10094f.exe	28
PID 2600 wrote to memory of 3012	2600	36859d69bc504dea453f69c84e10094f.exe	28
PID 2600 wrote to memory of 3012	2600	36859d69bc504dea453f69c84e10094f.exe	28

C:\Users\Admin\AppData\Local\Temp\36859d69bc504dea453f69c84e10094f.exe
"C:\Users\Admin\AppData\Local\Temp\36859d69bc504dea453f69c84e10094f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 144
  2⤵
  - Program crash
  PID:3012

memory/2600-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2600-1-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download