5a0c258a5dd82af533e40260e02b3f284c297966563e0a55ec8bbebf1f8495f7

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 14:45

Target

769a81c240ee4a618d4d1f738f933923.exe
Size

83KB
MD5

769a81c240ee4a618d4d1f738f933923
SHA1

72b28ab86883571754e33b567054f8f78dc18226
SHA256

5a0c258a5dd82af533e40260e02b3f284c297966563e0a55ec8bbebf1f8495f7
SHA512

af69ff5efb1b664125a22417aae1fa9adf6274910999ecb0e92b66c3ff42a77bcf01a7a1d92e3d8df3ee6b36e06bdf7710eaa9eda85ce4315e8c619fb8442cab
SSDEEP

1536:GqhhhWrvLaZchA8uJdn6PP6UsoduMpma/tkQk0z2QKuQpFPblpjVrs2ryrd1vUQe:GqhhhAGZchA8uJdn6Pr3BpmaiXQKuQpk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1900	2640	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 1900	2640	769a81c240ee4a618d4d1f738f933923.exe	28
PID 2640 wrote to memory of 1900	2640	769a81c240ee4a618d4d1f738f933923.exe	28
PID 2640 wrote to memory of 1900	2640	769a81c240ee4a618d4d1f738f933923.exe	28
PID 2640 wrote to memory of 1900	2640	769a81c240ee4a618d4d1f738f933923.exe	28

C:\Users\Admin\AppData\Local\Temp\769a81c240ee4a618d4d1f738f933923.exe
"C:\Users\Admin\AppData\Local\Temp\769a81c240ee4a618d4d1f738f933923.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 36
  2⤵
  - Program crash
  PID:1900

memory/2640-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download