47913e80d00589624ba9fa8a55647df999150f388bf087667f17f6ec53f20f12

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 03:22

Target

26388a59ef61f7ab054229c3ecc60be8.exe
Size

31KB
MD5

26388a59ef61f7ab054229c3ecc60be8
SHA1

3d1c0f90d4b3158cf2c8660a54dc4f5565dbe297
SHA256

47913e80d00589624ba9fa8a55647df999150f388bf087667f17f6ec53f20f12
SHA512

eda7f76a4227366e4fe9a7b58d21d6c8f41547199aa3505184fa73260fc0a71fe95a73733c0f7fc10aba569264b4718e69c5af304870e7c106aa3b38906de97f
SSDEEP

768:Daj50AlwgbSA8+AXZa8LsJQf32QELFUXFOhJfQtiqVhp4osww9:uVxFP8+AozJQOQELFUFOhJfQtbhyzwO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2392	2764	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2392	2764	26388a59ef61f7ab054229c3ecc60be8.exe	28
PID 2764 wrote to memory of 2392	2764	26388a59ef61f7ab054229c3ecc60be8.exe	28
PID 2764 wrote to memory of 2392	2764	26388a59ef61f7ab054229c3ecc60be8.exe	28
PID 2764 wrote to memory of 2392	2764	26388a59ef61f7ab054229c3ecc60be8.exe	28

C:\Users\Admin\AppData\Local\Temp\26388a59ef61f7ab054229c3ecc60be8.exe
"C:\Users\Admin\AppData\Local\Temp\26388a59ef61f7ab054229c3ecc60be8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 36
  2⤵
  - Program crash
  PID:2392

memory/2764-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download