a628737c0ea101f1a3de933db84cb29f1f7723ffee7df31af8fdcd3c55b0b402

Analysis

max time kernel
119s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 05:13

Target

0fbc5088b4ba5bef4b6187ee31fde741.exe
Size

15KB
MD5

0fbc5088b4ba5bef4b6187ee31fde741
SHA1

a01e0ba6290662cd6e414f236f82762346d4ee43
SHA256

a628737c0ea101f1a3de933db84cb29f1f7723ffee7df31af8fdcd3c55b0b402
SHA512

c99629659d323cfed99da1ebf352a1a5d9e74b67c7eccc89e7a9abe71c352d88bc3cee227a04e8d010ea7a4bf4ae22f7518dd87dff520a7e9595c7a8f37b48e6
SSDEEP

384:1s0brmbn6SM32x+15MPKVVy/ftWQ6bRwiNbFO6ITlM8/v:1su4nB0hVeftWRGiNvClM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2528	2636	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2528	2636	0fbc5088b4ba5bef4b6187ee31fde741.exe	28
PID 2636 wrote to memory of 2528	2636	0fbc5088b4ba5bef4b6187ee31fde741.exe	28
PID 2636 wrote to memory of 2528	2636	0fbc5088b4ba5bef4b6187ee31fde741.exe	28
PID 2636 wrote to memory of 2528	2636	0fbc5088b4ba5bef4b6187ee31fde741.exe	28

C:\Users\Admin\AppData\Local\Temp\0fbc5088b4ba5bef4b6187ee31fde741.exe
"C:\Users\Admin\AppData\Local\Temp\0fbc5088b4ba5bef4b6187ee31fde741.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 36
  2⤵
  - Program crash
  PID:2528