4357df9f7905f08ed656f3266ff2618ce6bdc26150dbfdc541e97fe506267b5c

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 19:10

Target

36ea6ac6e85120ff9ac712c257a9cbb3.exe
Size

78KB
MD5

36ea6ac6e85120ff9ac712c257a9cbb3
SHA1

4f9e67379bab97e17f10d53e251d60498e3ae4f8
SHA256

4357df9f7905f08ed656f3266ff2618ce6bdc26150dbfdc541e97fe506267b5c
SHA512

44a5dac546a0aa07f52da79ca9d05ed702d56a20284596094e332ebf295fadbd52b09ac1392ffe13e8016c62ce2e7247ef9c92ae989b195881d6d207a32cc89c
SSDEEP

1536:qILaz1awjy387Ml84R+uQHzmmxtPa8/pxDEbDBa9P66MJx8Fpr:qILaRjK8ApOq8/pabDY96WL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2052	2132	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2052	2132	36ea6ac6e85120ff9ac712c257a9cbb3.exe	28
PID 2132 wrote to memory of 2052	2132	36ea6ac6e85120ff9ac712c257a9cbb3.exe	28
PID 2132 wrote to memory of 2052	2132	36ea6ac6e85120ff9ac712c257a9cbb3.exe	28
PID 2132 wrote to memory of 2052	2132	36ea6ac6e85120ff9ac712c257a9cbb3.exe	28

C:\Users\Admin\AppData\Local\Temp\36ea6ac6e85120ff9ac712c257a9cbb3.exe
"C:\Users\Admin\AppData\Local\Temp\36ea6ac6e85120ff9ac712c257a9cbb3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 148
  2⤵
  - Program crash
  PID:2052

memory/2132-0-0x0000000000400000-0x0000000000407124-memory.dmp

Filesize
28KB

Download
memory/2132-1-0x0000000000400000-0x0000000000407124-memory.dmp

Filesize
28KB

Download