f0a2a81e19e149731c27537cce7bfbcbf5cbf64b3c6a906b64a66588a197264e

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 07:45

Target

5d5fd62ed33e4ae81388c377b902f8f6.exe
Size

76KB
MD5

5d5fd62ed33e4ae81388c377b902f8f6
SHA1

d5f446c519c18ce613c02b77f984ced976009bc3
SHA256

f0a2a81e19e149731c27537cce7bfbcbf5cbf64b3c6a906b64a66588a197264e
SHA512

2e675f789356d52510358110e2256ef55b28b5073ef3106bd9ed1484fa1eb51b555450dd16bfb155f1a41ce4c53062b0ef6a87cddb72a133c3b3b46f230fa416
SSDEEP

1536:C/ePyXHZ7DA4BfBrmTiXvvvUgbFNCuACP1DIgN:oeSHZ7DTBfBrB/UgbFNCuAq2C

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
3020	2144	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 3020	2144	5d5fd62ed33e4ae81388c377b902f8f6.exe	14
PID 2144 wrote to memory of 3020	2144	5d5fd62ed33e4ae81388c377b902f8f6.exe	14
PID 2144 wrote to memory of 3020	2144	5d5fd62ed33e4ae81388c377b902f8f6.exe	14
PID 2144 wrote to memory of 3020	2144	5d5fd62ed33e4ae81388c377b902f8f6.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 108
1⤵
- Program crash
PID:3020

C:\Users\Admin\AppData\Local\Temp\5d5fd62ed33e4ae81388c377b902f8f6.exe
"C:\Users\Admin\AppData\Local\Temp\5d5fd62ed33e4ae81388c377b902f8f6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2144

memory/2144-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download