8eb2298b4944d182a17507d37dfff5635607cdaff08f301f8fa962e0d2adfdcf

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 19:12

Target

37032b43bfc3c4dd72094d6b6433c982.exe
Size

10KB
MD5

37032b43bfc3c4dd72094d6b6433c982
SHA1

c2c63a9568b1f09f8fe8ab008dcbf35f00431a5a
SHA256

8eb2298b4944d182a17507d37dfff5635607cdaff08f301f8fa962e0d2adfdcf
SHA512

00a06df04eaf597808d618f7ca6f72069d5ffcae3ebd10139d2019597a0b1e6c821500bb0f6d2ad50273fd881de12f2c188eead9af191a9cf7197e8aea3dafad
SSDEEP

192:o7q5Zj/rK5JQZ1N9Y9wqEtrMTgsAOiAWi1Vzs7UgCtVKky/:1ZjOaN9eEouqnw72Kj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2628	2472	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2628	2472	37032b43bfc3c4dd72094d6b6433c982.exe	16
PID 2472 wrote to memory of 2628	2472	37032b43bfc3c4dd72094d6b6433c982.exe	16
PID 2472 wrote to memory of 2628	2472	37032b43bfc3c4dd72094d6b6433c982.exe	16
PID 2472 wrote to memory of 2628	2472	37032b43bfc3c4dd72094d6b6433c982.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 36
1⤵
- Program crash
PID:2628

C:\Users\Admin\AppData\Local\Temp\37032b43bfc3c4dd72094d6b6433c982.exe
"C:\Users\Admin\AppData\Local\Temp\37032b43bfc3c4dd72094d6b6433c982.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2472

memory/2472-0-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download