5f06e0c0805a9daa9537adabb8cc72d628a2dca3f8c9d2bff0c8cab18d392918

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 02:31

Target

248e6632fcc179afd15dcbc7710fc589.exe
Size

55KB
MD5

248e6632fcc179afd15dcbc7710fc589
SHA1

5d0ff2f9e9e89d92a50de8379c17056153dc98b4
SHA256

5f06e0c0805a9daa9537adabb8cc72d628a2dca3f8c9d2bff0c8cab18d392918
SHA512

6f801be16d833b67b20cc5d8f6a6c667575ce19bcf7fb2507771051741516b402cf2892be413c1f1897a7944e758c0b1bfafc43f8865738cd2157271a0c28ded
SSDEEP

768:dJn1XZb3ByriFXMfcG++vpJpgSgdhsSW5utzIjZsKS+SiEYGjRX0Kwbzvc5T+I:DbxaiFXfG+oTgbzIjZ6VRX0vHud

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2464	2404	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2464	2404	248e6632fcc179afd15dcbc7710fc589.exe	15
PID 2404 wrote to memory of 2464	2404	248e6632fcc179afd15dcbc7710fc589.exe	15
PID 2404 wrote to memory of 2464	2404	248e6632fcc179afd15dcbc7710fc589.exe	15
PID 2404 wrote to memory of 2464	2404	248e6632fcc179afd15dcbc7710fc589.exe	15

C:\Users\Admin\AppData\Local\Temp\248e6632fcc179afd15dcbc7710fc589.exe
"C:\Users\Admin\AppData\Local\Temp\248e6632fcc179afd15dcbc7710fc589.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 88
  2⤵
  - Program crash
  PID:2464

memory/2404-1-0x0000000000220000-0x000000000022C000-memory.dmp

Filesize
48KB

Download
memory/2404-0-0x0000000000400000-0x00000000004115ED-memory.dmp

Filesize
69KB

Download