85a87dbd3424955cfefb799430ba3f99cff61a1bb8d103d335bbae91a863d6c3

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:49

Target

2526e58727e4481a6e50bde74ec227fc.exe
Size

430KB
MD5

2526e58727e4481a6e50bde74ec227fc
SHA1

2184f1b3df1b7008ff83cd8b475982e2db37215d
SHA256

85a87dbd3424955cfefb799430ba3f99cff61a1bb8d103d335bbae91a863d6c3
SHA512

001588363fc15f5b4b6580f44139c50e4f59edb2ba9b3d1456dd483b2afe2e40b69538b00824199d55e064c8aefcd2eb2ca9479c6e8aa35fef51d471171cad23
SSDEEP

6144:Ulsy4TNbEm1B1zzqaCh9Ju/2x+vw0b8ajNglS2+gUXpP9YC4r:UdwNIm1B1zzqrh9Jf+btwSfgUnBI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2876	2288	WerFault.exe	7

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2876	2288	2526e58727e4481a6e50bde74ec227fc.exe	28
PID 2288 wrote to memory of 2876	2288	2526e58727e4481a6e50bde74ec227fc.exe	28
PID 2288 wrote to memory of 2876	2288	2526e58727e4481a6e50bde74ec227fc.exe	28
PID 2288 wrote to memory of 2876	2288	2526e58727e4481a6e50bde74ec227fc.exe	28

C:\Users\Admin\AppData\Local\Temp\2526e58727e4481a6e50bde74ec227fc.exe
"C:\Users\Admin\AppData\Local\Temp\2526e58727e4481a6e50bde74ec227fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 116
  2⤵
  - Program crash
  PID:2876

memory/2288-0-0x00000000010C0000-0x0000000001130000-memory.dmp

Filesize
448KB

Download