3fe1004b169376b123d958ef9bf48c6c21f16f46abc7f418638c6ba74636bdca

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 20:48

Target

03965c7eb0d856fc07639a11068e7037.exe
Size

96KB
MD5

03965c7eb0d856fc07639a11068e7037
SHA1

336dfa5949e85b8c4ffa928a6666906cf93c229c
SHA256

3fe1004b169376b123d958ef9bf48c6c21f16f46abc7f418638c6ba74636bdca
SHA512

a9ff15aec10d8c7d37dee198cf2b6ad8ba5e1376e45fac0bff87ad73e8ca0262cac9efaf82d1409d64941391106290ae1d88df20ff2f2348f1883f72bbf1a8f5
SSDEEP

768:z06R0UKzOgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9f:xR0vxn3Pc0LCH9MtbvabUDzJYWu3Bg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1388	2532	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1388	2532	03965c7eb0d856fc07639a11068e7037.exe	28
PID 2532 wrote to memory of 1388	2532	03965c7eb0d856fc07639a11068e7037.exe	28
PID 2532 wrote to memory of 1388	2532	03965c7eb0d856fc07639a11068e7037.exe	28
PID 2532 wrote to memory of 1388	2532	03965c7eb0d856fc07639a11068e7037.exe	28

C:\Users\Admin\AppData\Local\Temp\03965c7eb0d856fc07639a11068e7037.exe
"C:\Users\Admin\AppData\Local\Temp\03965c7eb0d856fc07639a11068e7037.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 156
  2⤵
  - Program crash
  PID:1388

memory/2532-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download