818a9766c6c4fa904cb70ce869331b70e12942494f0b072abbbd3a465e822b4c

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 08:07

Target

5e856c73d28dbf2d337617ccec498632.exe
Size

361KB
MD5

5e856c73d28dbf2d337617ccec498632
SHA1

fa53fec8dcbab22d472ec09d9a322dcd33208b73
SHA256

818a9766c6c4fa904cb70ce869331b70e12942494f0b072abbbd3a465e822b4c
SHA512

50f5f4a912761772c20c8c6498b1debee0c8702a75cf43d026798381302f3a3a69b01a8abea9198780b2c12fb5f4b55c17a7bcc663bb1a2f96ac78ed68b2e9f6
SSDEEP

6144:m1sPWg6R6/6j3xTWxLyGlfOwZ3vRHevcb/dXRCNprnzJU5aXmoMalX:rPKR6/6j3x6x5J+vcArn9U5a2gX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2980	2888	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2980	2888	5e856c73d28dbf2d337617ccec498632.exe	29
PID 2888 wrote to memory of 2980	2888	5e856c73d28dbf2d337617ccec498632.exe	29
PID 2888 wrote to memory of 2980	2888	5e856c73d28dbf2d337617ccec498632.exe	29
PID 2888 wrote to memory of 2980	2888	5e856c73d28dbf2d337617ccec498632.exe	29

C:\Users\Admin\AppData\Local\Temp\5e856c73d28dbf2d337617ccec498632.exe
"C:\Users\Admin\AppData\Local\Temp\5e856c73d28dbf2d337617ccec498632.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 500
  2⤵
  - Program crash
  PID:2980

memory/2888-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2888-1-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download