f008564f5aeae89ac65640feae6f91f06b09d701943b0258f2066b1236a40566

Analysis

max time kernel
142s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 07:45

Target

5d5491cf4e0cec4985db8eac9006659f.exe
Size

64KB
MD5

5d5491cf4e0cec4985db8eac9006659f
SHA1

f6e6516e357ef79886570cb6d47fdb2c2f3893d5
SHA256

f008564f5aeae89ac65640feae6f91f06b09d701943b0258f2066b1236a40566
SHA512

f79855c9d1d8ef02bbf621c2a1e5b42367f6b37619f496e782e93e23677247345ab49c424d710ff5aad9cd136d49d5a08a82839969366925daa0c25ea1fd8451
SSDEEP

1536:QmaoDu3BN95/g4byc6H5c6HcT66vlm3GGk5EBxL3H:JyH99g4byc6H5c6HcT66vlmm+BpH

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	5d5491cf4e0cec4985db8eac9006659f.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	2212	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2224	2212	5d5491cf4e0cec4985db8eac9006659f.exe	17
PID 2212 wrote to memory of 2224	2212	5d5491cf4e0cec4985db8eac9006659f.exe	17
PID 2212 wrote to memory of 2224	2212	5d5491cf4e0cec4985db8eac9006659f.exe	17
PID 2212 wrote to memory of 2224	2212	5d5491cf4e0cec4985db8eac9006659f.exe	17

C:\Users\Admin\AppData\Local\Temp\5d5491cf4e0cec4985db8eac9006659f.exe
"C:\Users\Admin\AppData\Local\Temp\5d5491cf4e0cec4985db8eac9006659f.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 72
  2⤵
  - Program crash
  PID:2224

memory/2212-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download