62f8f45a543f5e04a89d3ffec469c64554f302b994b33e8967c906fd376f9051

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 09:43

Target

64a8ba3361dd92ee675374c2e4a9d134.exe
Size

321KB
MD5

64a8ba3361dd92ee675374c2e4a9d134
SHA1

3805806383c7317329a40530c8241ec8f536a480
SHA256

62f8f45a543f5e04a89d3ffec469c64554f302b994b33e8967c906fd376f9051
SHA512

8cb77ba6b8682fddba82557580759c707bd796dbfe4bffca818269cd0ce6024ed2abe48687613f2fe37a67c28ba6cadf0f7408a4ca8d5dc5bd4f4a834f4dc792
SSDEEP

6144:OTj1OTEKnsub1upoH7td/tQqG56Prd3Z5NBA3r14lJDNIl:OFOoKnsub6oHprG5+3a7STY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1392	1692	WerFault.exe	9

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1392	1692	64a8ba3361dd92ee675374c2e4a9d134.exe	28
PID 1692 wrote to memory of 1392	1692	64a8ba3361dd92ee675374c2e4a9d134.exe	28
PID 1692 wrote to memory of 1392	1692	64a8ba3361dd92ee675374c2e4a9d134.exe	28
PID 1692 wrote to memory of 1392	1692	64a8ba3361dd92ee675374c2e4a9d134.exe	28

C:\Users\Admin\AppData\Local\Temp\64a8ba3361dd92ee675374c2e4a9d134.exe
"C:\Users\Admin\AppData\Local\Temp\64a8ba3361dd92ee675374c2e4a9d134.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 116
  2⤵
  - Program crash
  PID:1392

memory/1692-0-0x0000000000860000-0x00000000008B5000-memory.dmp

Filesize
340KB

Download