34d7c842db004d12da73ebef5502b74269881a72047ccdab97e01173e300d55a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 00:06

Target

45317ed815dece79baac8fe722260026.exe
Size

344KB
MD5

45317ed815dece79baac8fe722260026
SHA1

336bb9b93925f3de7e48c17cd848c452b4dd58e3
SHA256

34d7c842db004d12da73ebef5502b74269881a72047ccdab97e01173e300d55a
SHA512

3878982f6afab721c4429d9fcbd019b1adac2aefe663909691e9d636f9489b37d563f7220585dafe7aec01eb8fe50a1bc75fc88a26bfabd2c3c8e6678f05b4e3
SSDEEP

6144:A/T3zd9AVAixibDqwbKhqjX9kjeKHYFqoECLrLnZF7tGUP+BgkTbXD/3/:A/XM4DShe9EcHPLrLZ5AICgkTP3/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1792	2868	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 1792	2868	45317ed815dece79baac8fe722260026.exe	28
PID 2868 wrote to memory of 1792	2868	45317ed815dece79baac8fe722260026.exe	28
PID 2868 wrote to memory of 1792	2868	45317ed815dece79baac8fe722260026.exe	28
PID 2868 wrote to memory of 1792	2868	45317ed815dece79baac8fe722260026.exe	28

C:\Users\Admin\AppData\Local\Temp\45317ed815dece79baac8fe722260026.exe
"C:\Users\Admin\AppData\Local\Temp\45317ed815dece79baac8fe722260026.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 132
  2⤵
  - Program crash
  PID:1792