cdf5053d4087e1163564b4629a31475305ab5c95f4582849126119e4aa23f944

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 04:24

Target

280fcb3d5d6f966d8d737ed854c8f9f5.exe
Size

7KB
MD5

280fcb3d5d6f966d8d737ed854c8f9f5
SHA1

c1046983825ab3fd502c5868e34057bbfccd6ec6
SHA256

cdf5053d4087e1163564b4629a31475305ab5c95f4582849126119e4aa23f944
SHA512

30a1fafa1a0147448907095079aa01360270ee2b33cea2dcf21a00b073b6777ee484028b2a48fd894abb24b5fb43a0802e10738c66ed6179322f385dd7f63276
SSDEEP

96:HokWE5Z0gpkkABxkq1Qgd8p3xRINlxlSeMIEyUxJTm53cfiulVARiEWrcNMHGAp:HdOLkqq5KNjlexSHulRQMHV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2788	2852	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2788	2852	280fcb3d5d6f966d8d737ed854c8f9f5.exe	28
PID 2852 wrote to memory of 2788	2852	280fcb3d5d6f966d8d737ed854c8f9f5.exe	28
PID 2852 wrote to memory of 2788	2852	280fcb3d5d6f966d8d737ed854c8f9f5.exe	28
PID 2852 wrote to memory of 2788	2852	280fcb3d5d6f966d8d737ed854c8f9f5.exe	28

C:\Users\Admin\AppData\Local\Temp\280fcb3d5d6f966d8d737ed854c8f9f5.exe
"C:\Users\Admin\AppData\Local\Temp\280fcb3d5d6f966d8d737ed854c8f9f5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 88
  2⤵
  - Program crash
  PID:2788

memory/2852-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2852-1-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download