617b5501632e12798d9d4fd4caa9bb223f75cca0dcdf4f885cf41f4687b2adfb

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:16

Target

09cb9c2538ba615e4ec8c9160220383f.exe
Size

88KB
MD5

09cb9c2538ba615e4ec8c9160220383f
SHA1

9e40810c42d77fec6c5e0b3ae627e94838955a39
SHA256

617b5501632e12798d9d4fd4caa9bb223f75cca0dcdf4f885cf41f4687b2adfb
SHA512

6f8227cad838da14bb3fd2963394cc6a727ce8ea7198df46291608d12bac2ead845d653cc17ac1fc5419812a8e1f0b392cd1ed9cf440137b20af0b9b3abc444d
SSDEEP

1536:MrSXuNgsn/yaOYP5w/Fv99MIKQjNQIz5+Lq6vD5p1TsYhLPej1YT1RBfvZFx80Nt:MrSXu+xYP5wdfMIxjNr5+XD/1AYh+S1p

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3028	2300	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 3028	2300	09cb9c2538ba615e4ec8c9160220383f.exe	28
PID 2300 wrote to memory of 3028	2300	09cb9c2538ba615e4ec8c9160220383f.exe	28
PID 2300 wrote to memory of 3028	2300	09cb9c2538ba615e4ec8c9160220383f.exe	28
PID 2300 wrote to memory of 3028	2300	09cb9c2538ba615e4ec8c9160220383f.exe	28

C:\Users\Admin\AppData\Local\Temp\09cb9c2538ba615e4ec8c9160220383f.exe
"C:\Users\Admin\AppData\Local\Temp\09cb9c2538ba615e4ec8c9160220383f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 36
  2⤵
  - Program crash
  PID:3028