f7a1448c673d58f7e1e3a3877882a88151ba95ed037b890c659baea07914722f

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:07

Target

052e54b071a933b645f5c943f7afe479.exe
Size

523KB
MD5

052e54b071a933b645f5c943f7afe479
SHA1

bc2ce0b2718ca77375e3705d78bfb4a041bff2b6
SHA256

f7a1448c673d58f7e1e3a3877882a88151ba95ed037b890c659baea07914722f
SHA512

275c6e1942e7402f780dd285069eca7798fb34d0982767baaee91d2ce48ccbd33df85081414775ff3acd0c04d4772c0eb058a897d98ceeacecf9db473bbc6425
SSDEEP

12288:TVGf85GkxohcpOB/mRGNk/e8Fys3SmgJ8jVq23MN:ZGf85Cc89pEys3SmgsVr3o

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1864	3044	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 1864	3044	052e54b071a933b645f5c943f7afe479.exe	28
PID 3044 wrote to memory of 1864	3044	052e54b071a933b645f5c943f7afe479.exe	28
PID 3044 wrote to memory of 1864	3044	052e54b071a933b645f5c943f7afe479.exe	28
PID 3044 wrote to memory of 1864	3044	052e54b071a933b645f5c943f7afe479.exe	28

C:\Users\Admin\AppData\Local\Temp\052e54b071a933b645f5c943f7afe479.exe
"C:\Users\Admin\AppData\Local\Temp\052e54b071a933b645f5c943f7afe479.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 104
  2⤵
  - Program crash
  PID:1864