82e5152e22bbd39fe01bce80c73158ac48ed8274a9ac541ea6666005c5ae6874

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 04:18

Target

537d5187e328bd5389b90ff8f675aa57.exe
Size

429KB
MD5

537d5187e328bd5389b90ff8f675aa57
SHA1

f782790771598bf236d664c9c62ee8f2bb417b86
SHA256

82e5152e22bbd39fe01bce80c73158ac48ed8274a9ac541ea6666005c5ae6874
SHA512

58db01095c9678f03292a214704e271e544a84e2daf4f9f4033f168efe8aaa56c8ad45d40066536d12b756836030848cbda7d8b56e411970336e6008f57cd402
SSDEEP

6144:AYbWW2WDmyUUqK5EhEMDMg48Td50WKtNvGRNxw8QUY:AhWjmyUUqK5j030TyNC8Q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1700	3032	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 1700	3032	537d5187e328bd5389b90ff8f675aa57.exe	28
PID 3032 wrote to memory of 1700	3032	537d5187e328bd5389b90ff8f675aa57.exe	28
PID 3032 wrote to memory of 1700	3032	537d5187e328bd5389b90ff8f675aa57.exe	28
PID 3032 wrote to memory of 1700	3032	537d5187e328bd5389b90ff8f675aa57.exe	28

C:\Users\Admin\AppData\Local\Temp\537d5187e328bd5389b90ff8f675aa57.exe
"C:\Users\Admin\AppData\Local\Temp\537d5187e328bd5389b90ff8f675aa57.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 116
  2⤵
  - Program crash
  PID:1700

memory/3032-0-0x00000000003A0000-0x0000000000410000-memory.dmp

Filesize
448KB

Download