cb8af95e9b9b67d6283f82bd756d0da3edcffa0729c1c945d89a03a1404f80f8

Analysis

max time kernel
142s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 20:09

Target

3a5c28c07a4e560330dac42033e3e13a.exe
Size

46KB
MD5

3a5c28c07a4e560330dac42033e3e13a
SHA1

605ea34a65915c56a8610bca00eed46851e6ed24
SHA256

cb8af95e9b9b67d6283f82bd756d0da3edcffa0729c1c945d89a03a1404f80f8
SHA512

8c8204ab883a8a513b9b5cfe275870b60b1f8fcdf9c732fa16002a1880a78e114faf7cfa2c7f1f2ad64a176d0235d17a5ce0e451f567579bf8a64dcbaf226ace
SSDEEP

768:nhZPqZgIEnY4shBSXC3dBT17njuohjdsq+Vwul+b5xi1E3Vk1YbhEw0rSJB:/PqZgIEOhkjohjdsq+VwulU9B

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1108	1380	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1108	1380	3a5c28c07a4e560330dac42033e3e13a.exe	28
PID 1380 wrote to memory of 1108	1380	3a5c28c07a4e560330dac42033e3e13a.exe	28
PID 1380 wrote to memory of 1108	1380	3a5c28c07a4e560330dac42033e3e13a.exe	28
PID 1380 wrote to memory of 1108	1380	3a5c28c07a4e560330dac42033e3e13a.exe	28

C:\Users\Admin\AppData\Local\Temp\3a5c28c07a4e560330dac42033e3e13a.exe
"C:\Users\Admin\AppData\Local\Temp\3a5c28c07a4e560330dac42033e3e13a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 144
  2⤵
  - Program crash
  PID:1108

memory/1380-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download