5d6cf3ffb41fbcd9739bafc2b18aa300224e4c7cd9bfe05cdcca0b5389cc8590

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:05

Target

276c07ab2951ea151a42708e77445bd0.exe
Size

19KB
MD5

276c07ab2951ea151a42708e77445bd0
SHA1

45d649e368656c3055a700684d19ef0711606520
SHA256

5d6cf3ffb41fbcd9739bafc2b18aa300224e4c7cd9bfe05cdcca0b5389cc8590
SHA512

a3f8a36c0a2248e48462158182c502c01f92e125831f1b788005700d05b1e96d2eac2a458e17eacf2bd83a31d04f6db955a20fb47f1b342850a274fc06cc83f4
SSDEEP

384:70dYvLYq/NMQDe5ZM0wnOiY1TLKFHLEQMOlawxYM5:702zrDDiZM0wnOiIXcLEQVx5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
1948	1744	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1948	1744	276c07ab2951ea151a42708e77445bd0.exe	14
PID 1744 wrote to memory of 1948	1744	276c07ab2951ea151a42708e77445bd0.exe	14
PID 1744 wrote to memory of 1948	1744	276c07ab2951ea151a42708e77445bd0.exe	14
PID 1744 wrote to memory of 1948	1744	276c07ab2951ea151a42708e77445bd0.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 152
1⤵
- Program crash
PID:1948

C:\Users\Admin\AppData\Local\Temp\276c07ab2951ea151a42708e77445bd0.exe
"C:\Users\Admin\AppData\Local\Temp\276c07ab2951ea151a42708e77445bd0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1744

memory/1744-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1744-1-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download