e5e7d2eccbe1b657bd0809acbb742d57ecfd1eafe7c96a564fe990d9c627d941

Analysis

max time kernel
122s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 20:19

Target

3aec758a290a3704bb3ecf21ffbdf98a.exe
Size

112KB
MD5

3aec758a290a3704bb3ecf21ffbdf98a
SHA1

00f39483637d95ad4378a1de3dbf64f00d22fefe
SHA256

e5e7d2eccbe1b657bd0809acbb742d57ecfd1eafe7c96a564fe990d9c627d941
SHA512

141e9b41cb9555c8f848d1ea1dbc045d0066e9dcb66df60de8059c5fbf1289333bbfff1aa6560957142653b9734d7f82367270b72f56a679e30a211b62fd85d4
SSDEEP

3072:DQDpD3NgLtgP5r7QJz3wb/410zHT7zoI7h+aS1Go:DW9gL+P9iz3w8SH3zo0naGo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2284	2256	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2284	2256	3aec758a290a3704bb3ecf21ffbdf98a.exe	16
PID 2256 wrote to memory of 2284	2256	3aec758a290a3704bb3ecf21ffbdf98a.exe	16
PID 2256 wrote to memory of 2284	2256	3aec758a290a3704bb3ecf21ffbdf98a.exe	16
PID 2256 wrote to memory of 2284	2256	3aec758a290a3704bb3ecf21ffbdf98a.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 44
1⤵
- Program crash
PID:2284

C:\Users\Admin\AppData\Local\Temp\3aec758a290a3704bb3ecf21ffbdf98a.exe
"C:\Users\Admin\AppData\Local\Temp\3aec758a290a3704bb3ecf21ffbdf98a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256

memory/2256-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download