d5d1bb915947aafc020df58607b2dbc605999d147029eb042e77d479f16f44de

Analysis

max time kernel
142s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 05:15

Target

0fc73074559439ee462d5fe3f3c7c565.exe
Size

59KB
MD5

0fc73074559439ee462d5fe3f3c7c565
SHA1

905254fdce59bffd441a5bc4136b60e7b786a689
SHA256

d5d1bb915947aafc020df58607b2dbc605999d147029eb042e77d479f16f44de
SHA512

86641eabcec18290c209b22c979ef1f6e3c4ddf844f29e9cd614a7fd01a36c72ad3fce187c561bf19b30ff052700d77392098b0e7f473c0541397827dca65d7d
SSDEEP

768:qzkhdpmPzqI9UGRCn4dHHMu3n9jzwlxONRYCNn5Yqv2fzV07nRftqXzXBQg:53mPmIyQCnQHHMO54ONew5Yqv8EfwzX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3068	3016	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 3068	3016	0fc73074559439ee462d5fe3f3c7c565.exe	28
PID 3016 wrote to memory of 3068	3016	0fc73074559439ee462d5fe3f3c7c565.exe	28
PID 3016 wrote to memory of 3068	3016	0fc73074559439ee462d5fe3f3c7c565.exe	28
PID 3016 wrote to memory of 3068	3016	0fc73074559439ee462d5fe3f3c7c565.exe	28

C:\Users\Admin\AppData\Local\Temp\0fc73074559439ee462d5fe3f3c7c565.exe
"C:\Users\Admin\AppData\Local\Temp\0fc73074559439ee462d5fe3f3c7c565.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 36
  2⤵
  - Program crash
  PID:3068

memory/3016-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download