38e9e6410d5f045ebdbb970084f0ca02945c651fd9753bd3991697f4945cf651

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 22:25

Target

fcace6f38a80fe4aeda0237b9e4493e2.exe
Size

192KB
MD5

fcace6f38a80fe4aeda0237b9e4493e2
SHA1

28c247d1798e107dd60dab1f8aaf671d02f0b4f9
SHA256

38e9e6410d5f045ebdbb970084f0ca02945c651fd9753bd3991697f4945cf651
SHA512

5cf6ae6716de2c693fe7ccc18258855848606606663ec21f15c606a6cfbd1779557c0d27b364e0f277574f547f315e11b7e1596470d960a702373f8db6925234
SSDEEP

3072:qeEgXVMGX7s0SITvuFD4dQqOZysoCkUR5IrCYNsG5d3drafA45Ym5v:q4lVoVkvuFD4dQqOYo5o1tra4jm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2452	2472	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2452	2472	fcace6f38a80fe4aeda0237b9e4493e2.exe	25
PID 2472 wrote to memory of 2452	2472	fcace6f38a80fe4aeda0237b9e4493e2.exe	25
PID 2472 wrote to memory of 2452	2472	fcace6f38a80fe4aeda0237b9e4493e2.exe	25
PID 2472 wrote to memory of 2452	2472	fcace6f38a80fe4aeda0237b9e4493e2.exe	25

C:\Users\Admin\AppData\Local\Temp\fcace6f38a80fe4aeda0237b9e4493e2.exe
"C:\Users\Admin\AppData\Local\Temp\fcace6f38a80fe4aeda0237b9e4493e2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 132
  2⤵
  - Program crash
  PID:2452

memory/2472-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2472-2-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download