5ee2f057aff4a73fcc94da3ed8b81b21eb4436b07a49bf9ad46ac210004c14d4

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 08:55

Target

13dc88976f99677d70c90e78afd22345.exe
Size

368KB
MD5

13dc88976f99677d70c90e78afd22345
SHA1

20ec482223d5bcf62e59de3ac85ba818e3703822
SHA256

5ee2f057aff4a73fcc94da3ed8b81b21eb4436b07a49bf9ad46ac210004c14d4
SHA512

a3aeb8f41c58fc4e94d0729218d1dfe80834e8a6703756720e6deea77db9884b4f9a95dd163a0c58cf26293faab8371f646748025ad64602f9fcb9a863912eb2
SSDEEP

6144:RTAp4naqm5GR/0N4Ftn6vicI8qtQQenKDFujBeqSDgzB8jk3yN:R041m5Q/0N4L9xYus1NSD2Cg3M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2892	2536	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2892	2536	13dc88976f99677d70c90e78afd22345.exe	16
PID 2536 wrote to memory of 2892	2536	13dc88976f99677d70c90e78afd22345.exe	16
PID 2536 wrote to memory of 2892	2536	13dc88976f99677d70c90e78afd22345.exe	16
PID 2536 wrote to memory of 2892	2536	13dc88976f99677d70c90e78afd22345.exe	16

C:\Users\Admin\AppData\Local\Temp\13dc88976f99677d70c90e78afd22345.exe
"C:\Users\Admin\AppData\Local\Temp\13dc88976f99677d70c90e78afd22345.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 116
  2⤵
  - Program crash
  PID:2892

memory/2536-0-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Filesize
384KB

Download