168701ada38f0affa2755a78a599c393dc692dad530f510689346feacdf97ed6

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 09:23

Target

6372232295e46f5e2ab49e2dd841ce34.exe
Size

422KB
MD5

6372232295e46f5e2ab49e2dd841ce34
SHA1

26023e45599bab8d05fd25619b00fbabc7d9870e
SHA256

168701ada38f0affa2755a78a599c393dc692dad530f510689346feacdf97ed6
SHA512

1d09885516239617b6dc13836d159908034a249b4aff464fbf9599cb70d8893b09ebb440e0ee6e969ba8d88fe8274181eb54e38f53851431bcdece745b403070
SSDEEP

6144:ykB1INZdWaFzaE7mDGg7Y4+MFyBPys80G5sEOi9Ri9na5UVx3:ykBgdW/E7mDGg8xMkBp80GiZa5UVh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1300	2080	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1300	2080	6372232295e46f5e2ab49e2dd841ce34.exe	28
PID 2080 wrote to memory of 1300	2080	6372232295e46f5e2ab49e2dd841ce34.exe	28
PID 2080 wrote to memory of 1300	2080	6372232295e46f5e2ab49e2dd841ce34.exe	28
PID 2080 wrote to memory of 1300	2080	6372232295e46f5e2ab49e2dd841ce34.exe	28

C:\Users\Admin\AppData\Local\Temp\6372232295e46f5e2ab49e2dd841ce34.exe
"C:\Users\Admin\AppData\Local\Temp\6372232295e46f5e2ab49e2dd841ce34.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 116
  2⤵
  - Program crash
  PID:1300

memory/2080-0-0x00000000011B0000-0x000000000121E000-memory.dmp

Filesize
440KB

Download