4a96cb5ff35a31514b6a7f6c26fdadccaecda2804e92a02b6a8794ab0892a3c5

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 05:49

Target

106066e1273e528ed5b7c62cda63d71c.exe
Size

13KB
MD5

106066e1273e528ed5b7c62cda63d71c
SHA1

e5b8ac6da8867b8e60cdeb1ec42b314f77971c5c
SHA256

4a96cb5ff35a31514b6a7f6c26fdadccaecda2804e92a02b6a8794ab0892a3c5
SHA512

bffd2555101230feaabe5c560edc9239d23147994ec4738c236e49f7c66cb65cbd785cbe46ef673f06db718816a3f84162dc24112f949cc8414565ab00d865bc
SSDEEP

192:MzsuY5ANWkA54nDMdAonTTygKblarLvCOAihfSCpVdMn6cP6ZAdjNPVBG:MzsnLVC43TTBKHCpVKnRRjh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2952	2888	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2952	2888	106066e1273e528ed5b7c62cda63d71c.exe	28
PID 2888 wrote to memory of 2952	2888	106066e1273e528ed5b7c62cda63d71c.exe	28
PID 2888 wrote to memory of 2952	2888	106066e1273e528ed5b7c62cda63d71c.exe	28
PID 2888 wrote to memory of 2952	2888	106066e1273e528ed5b7c62cda63d71c.exe	28

C:\Users\Admin\AppData\Local\Temp\106066e1273e528ed5b7c62cda63d71c.exe
"C:\Users\Admin\AppData\Local\Temp\106066e1273e528ed5b7c62cda63d71c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 36
  2⤵
  - Program crash
  PID:2952

memory/2888-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2888-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download