38d15f782634dd60cb0289a3ab99e4f8f118fde4efddf96bfb21df05572b95c0

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 03:21

Target

2632861cbaaa9a3f1070d85e24ae9b84.exe
Size

120KB
MD5

2632861cbaaa9a3f1070d85e24ae9b84
SHA1

977771909fe9ffa00e1aa9ff8916e45dd6931034
SHA256

38d15f782634dd60cb0289a3ab99e4f8f118fde4efddf96bfb21df05572b95c0
SHA512

9b2678efcaaaa7be9f11e1a40771527ab992c5d3ceff58fd070343aca0989420442cc14462fafd3083d42114d704420bffba7b7a92a38aa1ef4cd61da1e1ddee
SSDEEP

1536:ZlHpPpo03z0oHwLVLrvXe3b0IscbC9EzCJu79+EaNaBQhgj7xTOc:Zlo0D0s4ZrfeBVzNJM7+j7cc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
312	2480	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 312	2480	2632861cbaaa9a3f1070d85e24ae9b84.exe	14
PID 2480 wrote to memory of 312	2480	2632861cbaaa9a3f1070d85e24ae9b84.exe	14
PID 2480 wrote to memory of 312	2480	2632861cbaaa9a3f1070d85e24ae9b84.exe	14
PID 2480 wrote to memory of 312	2480	2632861cbaaa9a3f1070d85e24ae9b84.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 152
1⤵
- Program crash
PID:312

C:\Users\Admin\AppData\Local\Temp\2632861cbaaa9a3f1070d85e24ae9b84.exe
"C:\Users\Admin\AppData\Local\Temp\2632861cbaaa9a3f1070d85e24ae9b84.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480