dbc98c6c773f2c66f1097af31cde03cf4098f5d32c6adfcb60895dbb4bcb92e7

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 08:06

Target

5e687307023d28b23ac79d6c728c64f7.exe
Size

45KB
MD5

5e687307023d28b23ac79d6c728c64f7
SHA1

127e3eb1ae230afca4fa4ff03dd2a5822d012576
SHA256

dbc98c6c773f2c66f1097af31cde03cf4098f5d32c6adfcb60895dbb4bcb92e7
SHA512

69d2b9fa89a61b2e38829f97b7bc329102dc067a67a27b4ddaa85bc6f06c0e89c9f08debe602443f1816601d36fd5cdc1ae2db17f1041b0811be6d6e665eb39d
SSDEEP

384:hDMX6PS5ddXCqfodIvNpPU833J8QZ+2P6vGvb/Oq4Q2QhvDBJ3:iASN1NpPUvnQOz+DBJ3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2920	2224	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2920	2224	5e687307023d28b23ac79d6c728c64f7.exe	28
PID 2224 wrote to memory of 2920	2224	5e687307023d28b23ac79d6c728c64f7.exe	28
PID 2224 wrote to memory of 2920	2224	5e687307023d28b23ac79d6c728c64f7.exe	28
PID 2224 wrote to memory of 2920	2224	5e687307023d28b23ac79d6c728c64f7.exe	28

C:\Users\Admin\AppData\Local\Temp\5e687307023d28b23ac79d6c728c64f7.exe
"C:\Users\Admin\AppData\Local\Temp\5e687307023d28b23ac79d6c728c64f7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 36
  2⤵
  - Program crash
  PID:2920

memory/2224-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download