5a7944ea66694e2401b7c4837df42a30dcc17edb1e387a33596678c76d8740f5

Analysis

max time kernel
141s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 00:28

Target

0896616024bbd459d222ca37b3971f7e.exe
Size

74KB
MD5

0896616024bbd459d222ca37b3971f7e
SHA1

314060c531098ae431e738912ca8bcf6b93b7e9f
SHA256

5a7944ea66694e2401b7c4837df42a30dcc17edb1e387a33596678c76d8740f5
SHA512

4fe30232a66704fc6f270022c1c9d47f6cf6e49eff5f9b8c654e711e28d467c2d7c42637ead226f6fd3cc7aadb45bc512b262321c5d0b77051bca656d7cea233
SSDEEP

1536:Mt7fM2k9FSeJWLTq9AjMilLLoSULAvFonfdSEcXiz/VCeRc:k7wJoTMCpzFo1xcyz/VCeR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3020	2964	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 3020	2964	0896616024bbd459d222ca37b3971f7e.exe	28
PID 2964 wrote to memory of 3020	2964	0896616024bbd459d222ca37b3971f7e.exe	28
PID 2964 wrote to memory of 3020	2964	0896616024bbd459d222ca37b3971f7e.exe	28
PID 2964 wrote to memory of 3020	2964	0896616024bbd459d222ca37b3971f7e.exe	28

C:\Users\Admin\AppData\Local\Temp\0896616024bbd459d222ca37b3971f7e.exe
"C:\Users\Admin\AppData\Local\Temp\0896616024bbd459d222ca37b3971f7e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 148
  2⤵
  - Program crash
  PID:3020

memory/2964-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2964-1-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2964-2-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download