09d8a3969d7d7ea093564f8f2aa3c0a8083c07174ed838b7f57fb26e20c6a8ac

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:08

Target

2787da5b067f7ea95a371759cd197f32.exe
Size

104KB
MD5

2787da5b067f7ea95a371759cd197f32
SHA1

3c6bc6b49aa34afbae62fd4e3c6d9e17dcc39b31
SHA256

09d8a3969d7d7ea093564f8f2aa3c0a8083c07174ed838b7f57fb26e20c6a8ac
SHA512

30c832a551cd669ee1baf91e52508c95fe9b76abe81ac9c3fd0d0f1cbc670f3a592de7080e9b2aea52a0efbf4e19a0d284a702443be61039896cefb90cb48d27
SSDEEP

1536:+/W0NjhAcBkD3RNE0fRQCM/rckfOc+ZtfCiq+g75izPSXPxd:+/W0NjNkD3nE+dYOBZVCiq9IzP4Pv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1752	1688	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1752	1688	2787da5b067f7ea95a371759cd197f32.exe	16
PID 1688 wrote to memory of 1752	1688	2787da5b067f7ea95a371759cd197f32.exe	16
PID 1688 wrote to memory of 1752	1688	2787da5b067f7ea95a371759cd197f32.exe	16
PID 1688 wrote to memory of 1752	1688	2787da5b067f7ea95a371759cd197f32.exe	16

C:\Users\Admin\AppData\Local\Temp\2787da5b067f7ea95a371759cd197f32.exe
"C:\Users\Admin\AppData\Local\Temp\2787da5b067f7ea95a371759cd197f32.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 116
  2⤵
  - Program crash
  PID:1752