f5900b25fc29ecc7d0a0b24543e4f255570f2e79e985ac02391d14379f16e2f7

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 08:37

Target

1393747797227a748c8af6d3ae2a4b0c.exe
Size

2.3MB
MD5

1393747797227a748c8af6d3ae2a4b0c
SHA1

9c7be971796802a9bd8c076cd73d86b339b15cc5
SHA256

f5900b25fc29ecc7d0a0b24543e4f255570f2e79e985ac02391d14379f16e2f7
SHA512

def42a8afdf9e39a8f7f031dcbcb2079c389b87d8a407505819cbe4a9aade864588bedaffedbb14e3aa04c1b0205bd843e3ef898fbf5e70ff72f48a03fa1d51c
SSDEEP

49152:mj5OrOO53RTqtitLfUplYvoGxUSJpXuyhNDS5lSy:mj5OrOO53AsRXuGNDS5lSy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
776	2232	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 776	2232	1393747797227a748c8af6d3ae2a4b0c.exe	16
PID 2232 wrote to memory of 776	2232	1393747797227a748c8af6d3ae2a4b0c.exe	16
PID 2232 wrote to memory of 776	2232	1393747797227a748c8af6d3ae2a4b0c.exe	16
PID 2232 wrote to memory of 776	2232	1393747797227a748c8af6d3ae2a4b0c.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 148
1⤵
- Program crash
PID:776

C:\Users\Admin\AppData\Local\Temp\1393747797227a748c8af6d3ae2a4b0c.exe
"C:\Users\Admin\AppData\Local\Temp\1393747797227a748c8af6d3ae2a4b0c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232