315f07b12d2b5c22268d2d6df8fb7084ea6193d93f70a2a75c57f10449345d0a

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:03

Target

23c5f13d8c6ff3fa2f6f188133a46857.exe
Size

27KB
MD5

23c5f13d8c6ff3fa2f6f188133a46857
SHA1

ce473666690d9d3ab5c8753bb0305cb7f58344af
SHA256

315f07b12d2b5c22268d2d6df8fb7084ea6193d93f70a2a75c57f10449345d0a
SHA512

907f3cca8f0939da3c1b87a039fc8058c4ff64eed4708eb0f6190c525fac937ab9474f2977c7b3d264701210a5e97b1fd1d5f599d4a05020f2e35e4def496482
SSDEEP

384:9xnNZsJS/PQIXJAWQtvJIwHo0XqfIp39ruQ0tAP8eR6yNsk:99LsJS/zXJmLlHLMIjAuNwHk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2292	2856	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2292	2856	23c5f13d8c6ff3fa2f6f188133a46857.exe	17
PID 2856 wrote to memory of 2292	2856	23c5f13d8c6ff3fa2f6f188133a46857.exe	17
PID 2856 wrote to memory of 2292	2856	23c5f13d8c6ff3fa2f6f188133a46857.exe	17
PID 2856 wrote to memory of 2292	2856	23c5f13d8c6ff3fa2f6f188133a46857.exe	17

C:\Users\Admin\AppData\Local\Temp\23c5f13d8c6ff3fa2f6f188133a46857.exe
"C:\Users\Admin\AppData\Local\Temp\23c5f13d8c6ff3fa2f6f188133a46857.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 92
  2⤵
  - Program crash
  PID:2292