71c6876d923e36d7b10910218a0b65fe1d7c82167fa0e70499b0cd0611753aeb

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 12:51

Target

36c672e15741b1e2ecc65affc83fb6c8.exe
Size

23KB
MD5

36c672e15741b1e2ecc65affc83fb6c8
SHA1

1d22b912fa6ac282ebeccc8b9f249749720c7ce5
SHA256

71c6876d923e36d7b10910218a0b65fe1d7c82167fa0e70499b0cd0611753aeb
SHA512

0918785e2c591784817b09888cbed2e52135a8ad48c9036d34e158bb7cbf97c1bae4424292b84220cc4d9c5da15f0dbc92b2da69e80f9999a8c6dd1083c400fa
SSDEEP

384:HkM1E4rJXv1Jy//l/zpx+iD1oWIXpHDgbrgff7ct1Do:VvBv0LqS1o3XpHDgwX7U1Do

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2668	3016	WerFault.exe	10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2668	3016	36c672e15741b1e2ecc65affc83fb6c8.exe	28
PID 3016 wrote to memory of 2668	3016	36c672e15741b1e2ecc65affc83fb6c8.exe	28
PID 3016 wrote to memory of 2668	3016	36c672e15741b1e2ecc65affc83fb6c8.exe	28
PID 3016 wrote to memory of 2668	3016	36c672e15741b1e2ecc65affc83fb6c8.exe	28

C:\Users\Admin\AppData\Local\Temp\36c672e15741b1e2ecc65affc83fb6c8.exe
"C:\Users\Admin\AppData\Local\Temp\36c672e15741b1e2ecc65affc83fb6c8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 68
  2⤵
  - Program crash
  PID:2668