e372e7e6af4b0bb3776fd2f33a54f734628ed4df4e33bd9ab0bb5af80caa998a

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:47

Target

0d66eadc55274f534d112e1c82cae528.exe
Size

315KB
MD5

0d66eadc55274f534d112e1c82cae528
SHA1

fc1e908ca5f7d3e23185e0cb7005b388b96d7825
SHA256

e372e7e6af4b0bb3776fd2f33a54f734628ed4df4e33bd9ab0bb5af80caa998a
SHA512

bf96008c81a8e25f380698026b8f06366668989e13680be11fd73da498317c13ac08ffa8ec70aebebf864f95f6e52c132909218e73d43b9498d5d194cbbde4d0
SSDEEP

6144:nkQRVYsVaKyMsrqRYFWrO6yAbhkrm9mHQLus/SPofGPi3+qiUumrUX9n:nzRS3KVZt3uB+GPv+Mn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2556	2184	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2556	2184	0d66eadc55274f534d112e1c82cae528.exe	28
PID 2184 wrote to memory of 2556	2184	0d66eadc55274f534d112e1c82cae528.exe	28
PID 2184 wrote to memory of 2556	2184	0d66eadc55274f534d112e1c82cae528.exe	28
PID 2184 wrote to memory of 2556	2184	0d66eadc55274f534d112e1c82cae528.exe	28

C:\Users\Admin\AppData\Local\Temp\0d66eadc55274f534d112e1c82cae528.exe
"C:\Users\Admin\AppData\Local\Temp\0d66eadc55274f534d112e1c82cae528.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 64
  2⤵
  - Program crash
  PID:2556

memory/2184-0-0x0000000000400000-0x0000000000428200-memory.dmp

Filesize
160KB

Download