bd2f4b29a67dbe2e6f008c739ed8e73ed82e0b1dab5b2d8ed4659d8704f65067

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 05:40

Target

57b3cbca0429cdae651c56b1acdf3329.exe
Size

212KB
MD5

57b3cbca0429cdae651c56b1acdf3329
SHA1

874acdd71b12c978801e1c5c0cd7b7e3e3878498
SHA256

bd2f4b29a67dbe2e6f008c739ed8e73ed82e0b1dab5b2d8ed4659d8704f65067
SHA512

944b29cc7fb9c1e972c376d23f33cd668cafd6179b36caf9c7f9f697a95a2ecf6fad8ae2d3697e9e2e4912211daaf6255aa02579619c9c08f2670f00eb47c2d6
SSDEEP

3072:cdt6Fd/Xdc31yI51F5/rj+dotPjLUqTOa3ZPa92cKX3/m5gjXzfbWOOV7el7OJN:owPo1yOZ23u3fbWOB4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
804	2268	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 804	2268	57b3cbca0429cdae651c56b1acdf3329.exe	14
PID 2268 wrote to memory of 804	2268	57b3cbca0429cdae651c56b1acdf3329.exe	14
PID 2268 wrote to memory of 804	2268	57b3cbca0429cdae651c56b1acdf3329.exe	14
PID 2268 wrote to memory of 804	2268	57b3cbca0429cdae651c56b1acdf3329.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 108
1⤵
- Program crash
PID:804

C:\Users\Admin\AppData\Local\Temp\57b3cbca0429cdae651c56b1acdf3329.exe
"C:\Users\Admin\AppData\Local\Temp\57b3cbca0429cdae651c56b1acdf3329.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2268

memory/2268-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download