52c3ff4f392528501aa2ea2a14b82085f210c6ba48cdfeff40e783ed2593ff6b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 04:02

Target

529cbbe210cb9c0f89e141c84c4c1f31.exe
Size

690KB
MD5

529cbbe210cb9c0f89e141c84c4c1f31
SHA1

90c2ecad41ea2da1023ad794c32ceb3de1e5e3dc
SHA256

52c3ff4f392528501aa2ea2a14b82085f210c6ba48cdfeff40e783ed2593ff6b
SHA512

7014661844bc4c25800de9cf2b533264a595b24f11904a97878731865032382332248e9e386014a1d43be907ec7839af617566fbfe497ee247aaee177a2767f0
SSDEEP

12288:AtOhlhOAPBAuxlVtD751epvRkQFzr/MpttzcfhVe:TnOAPBAuxlVtD11ep9Vr/+ttSE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2284	1904	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2284	1904	529cbbe210cb9c0f89e141c84c4c1f31.exe	16
PID 1904 wrote to memory of 2284	1904	529cbbe210cb9c0f89e141c84c4c1f31.exe	16
PID 1904 wrote to memory of 2284	1904	529cbbe210cb9c0f89e141c84c4c1f31.exe	16
PID 1904 wrote to memory of 2284	1904	529cbbe210cb9c0f89e141c84c4c1f31.exe	16

C:\Users\Admin\AppData\Local\Temp\529cbbe210cb9c0f89e141c84c4c1f31.exe
"C:\Users\Admin\AppData\Local\Temp\529cbbe210cb9c0f89e141c84c4c1f31.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 196
  2⤵
  - Program crash
  PID:2284

memory/1904-1-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/1904-0-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/1904-2-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download