e5e349f71fc10aabe967ccd0ff92011d735b9f3b6dce5cdb0d236e60434b874f

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 22:56

Target

fe4495a9c53efcfd33b889ec7b9911a5.exe
Size

432KB
MD5

fe4495a9c53efcfd33b889ec7b9911a5
SHA1

ae0bdfe44d3fa3efb30f7a6204ab975d0cd2d4e6
SHA256

e5e349f71fc10aabe967ccd0ff92011d735b9f3b6dce5cdb0d236e60434b874f
SHA512

49ac84b8233522ace1b322494316cb1d20d97857de3d4af0877315dad26388d8f9fe557b30617ae3686cefded3f5a5661e2c9f19a427474722c06d3a16a29242
SSDEEP

6144:fHk6/AxSQnytdpTSlLFlUbasKdmOsM7yZ4l49QI4M1cd8cH/5IfGekJVe3iu:HQnytOlZlUbataqI4MG8cfzJVe/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1344	1732	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1344	1732	fe4495a9c53efcfd33b889ec7b9911a5.exe	28
PID 1732 wrote to memory of 1344	1732	fe4495a9c53efcfd33b889ec7b9911a5.exe	28
PID 1732 wrote to memory of 1344	1732	fe4495a9c53efcfd33b889ec7b9911a5.exe	28
PID 1732 wrote to memory of 1344	1732	fe4495a9c53efcfd33b889ec7b9911a5.exe	28

C:\Users\Admin\AppData\Local\Temp\fe4495a9c53efcfd33b889ec7b9911a5.exe
"C:\Users\Admin\AppData\Local\Temp\fe4495a9c53efcfd33b889ec7b9911a5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 36
  2⤵
  - Program crash
  PID:1344