cd00d22d4ffce9a9dba5664c39127b0ad0956bb1cd7a1971bf823b97becd654e

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 04:05

Target

52c7c54f445a9230e020b8bef2b1edea.exe
Size

90KB
MD5

52c7c54f445a9230e020b8bef2b1edea
SHA1

79a34287ee248cc14ebed15136a1f03f9d63ae0c
SHA256

cd00d22d4ffce9a9dba5664c39127b0ad0956bb1cd7a1971bf823b97becd654e
SHA512

252926c639b058aef01db854b687f92c968a8f74d39929e9c74ca48b98229d4ff6ad5e9ee05b6490d5b709a648039507e3bb6c3ab8cfe94d464943d7630c6da5
SSDEEP

1536:W/LpMq/uNmm86GU5GsJnJULSKCqLzMkc2JvLnKuKVNqygU0neJp:W/tMqOXksJSLPDzMkLnzYNqyx0ne7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2372	2040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2372	2040	52c7c54f445a9230e020b8bef2b1edea.exe	28
PID 2040 wrote to memory of 2372	2040	52c7c54f445a9230e020b8bef2b1edea.exe	28
PID 2040 wrote to memory of 2372	2040	52c7c54f445a9230e020b8bef2b1edea.exe	28
PID 2040 wrote to memory of 2372	2040	52c7c54f445a9230e020b8bef2b1edea.exe	28

C:\Users\Admin\AppData\Local\Temp\52c7c54f445a9230e020b8bef2b1edea.exe
"C:\Users\Admin\AppData\Local\Temp\52c7c54f445a9230e020b8bef2b1edea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 148
  2⤵
  - Program crash
  PID:2372

memory/2040-0-0x0000000000400000-0x000000000040C890-memory.dmp

Filesize
50KB

Download