886fc51c697f9eba93dc37f8b634fc2b0be5f10e357161a0cfeefe93754ed7fb

Analysis

max time kernel
122s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 14:32

Target

75d415de5cf103d97c236cb79647650f.exe
Size

321KB
MD5

75d415de5cf103d97c236cb79647650f
SHA1

f4a538dfa9934c2d437e1570ee4d30ee9b4b149d
SHA256

886fc51c697f9eba93dc37f8b634fc2b0be5f10e357161a0cfeefe93754ed7fb
SHA512

d77bbe0362a10103edb6e08c250a8dbf992e449e35d092afe1623e1b7403d17eed0dc6c3a99657c73bc286eb040c13179d67084f45c90dc923de29159cd5be4d
SSDEEP

6144:rNxa/EJddK7vwK1poH7td/tQqG56Prd3Z5NBA3r12Ii:rO/YddK7vw0oHprG5+3a7O

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3040	1992	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 3040	1992	75d415de5cf103d97c236cb79647650f.exe	27
PID 1992 wrote to memory of 3040	1992	75d415de5cf103d97c236cb79647650f.exe	27
PID 1992 wrote to memory of 3040	1992	75d415de5cf103d97c236cb79647650f.exe	27
PID 1992 wrote to memory of 3040	1992	75d415de5cf103d97c236cb79647650f.exe	27

C:\Users\Admin\AppData\Local\Temp\75d415de5cf103d97c236cb79647650f.exe
"C:\Users\Admin\AppData\Local\Temp\75d415de5cf103d97c236cb79647650f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 116
  2⤵
  - Program crash
  PID:3040

memory/1992-0-0x0000000000830000-0x0000000000885000-memory.dmp

Filesize
340KB

Download