352aaf0536b8a41421b299d375b88cdecb3baff2eb369657cee7ec93ac11e408

Analysis

max time kernel
103s
max time network
41s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 03:21

Target

263371fca7675ebf216c64e9bbf84ce5.exe
Size

368KB
MD5

263371fca7675ebf216c64e9bbf84ce5
SHA1

e83dfb5759f79a03ab025505880233e47102e4aa
SHA256

352aaf0536b8a41421b299d375b88cdecb3baff2eb369657cee7ec93ac11e408
SHA512

d356f51cb92703fac1060fc550cb4aea953255b68c32053e96f02178ec64ac4d3ebbed4349950e21bbf96ecf569384753132bd869770495b0c760a8280a11a32
SSDEEP

6144:y5rCswCny7EDGoR+FuO4zK01DS9K1ap/HbTVPCWxXk950ibvZ0ZdD9Qeg/:y5rCsNny7Nu/zK01S9KsvbhaiU950egI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1568	1352	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1568	1352	263371fca7675ebf216c64e9bbf84ce5.exe	27
PID 1352 wrote to memory of 1568	1352	263371fca7675ebf216c64e9bbf84ce5.exe	27
PID 1352 wrote to memory of 1568	1352	263371fca7675ebf216c64e9bbf84ce5.exe	27
PID 1352 wrote to memory of 1568	1352	263371fca7675ebf216c64e9bbf84ce5.exe	27

C:\Users\Admin\AppData\Local\Temp\263371fca7675ebf216c64e9bbf84ce5.exe
"C:\Users\Admin\AppData\Local\Temp\263371fca7675ebf216c64e9bbf84ce5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 44
  2⤵
  - Program crash
  PID:1568

memory/1352-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1352-0-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/1352-2-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/1352-3-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download