08668549a4f8beaecdddcd4ea06043d8c7430798d5095556748cf19dd835633a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 06:41

Target

5a5188911c3d7c0803b7128f26ed7885.exe
Size

367KB
MD5

5a5188911c3d7c0803b7128f26ed7885
SHA1

0890dc1d9aa47d6db6cce361052afb703159d085
SHA256

08668549a4f8beaecdddcd4ea06043d8c7430798d5095556748cf19dd835633a
SHA512

3b395beed7bc80f0a89205317e823d07aca7f1debe3edfbd61a7d9ad3cd038c6c0e03cc87da3467734b9dea4c3bc9384d66ed8f72a4495fd94f11f6df36f5abe
SSDEEP

6144:rpEcAd/Mm5ZkyUneRTnJOmQ4W4/6zA5K0TzJRCp4xRvKUllD/W13+S:rTAOm5eyUnJmCzAXTzJR3RvK6lCwS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1704	2240	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1704	2240	5a5188911c3d7c0803b7128f26ed7885.exe	28
PID 2240 wrote to memory of 1704	2240	5a5188911c3d7c0803b7128f26ed7885.exe	28
PID 2240 wrote to memory of 1704	2240	5a5188911c3d7c0803b7128f26ed7885.exe	28
PID 2240 wrote to memory of 1704	2240	5a5188911c3d7c0803b7128f26ed7885.exe	28

C:\Users\Admin\AppData\Local\Temp\5a5188911c3d7c0803b7128f26ed7885.exe
"C:\Users\Admin\AppData\Local\Temp\5a5188911c3d7c0803b7128f26ed7885.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 116
  2⤵
  - Program crash
  PID:1704

memory/2240-0-0x00000000009F0000-0x0000000000A50000-memory.dmp

Filesize
384KB

Download