8a014bdbdf86f6c08f6c95a443b084473828f34ee1257b64a033619d0185ab97

Analysis

max time kernel
142s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 12:42

Target

36886c92a7d205d37d4dcf6450a86473.exe
Size

51KB
MD5

36886c92a7d205d37d4dcf6450a86473
SHA1

079aa014e3472a63e640147dbb9d0fe1f61db557
SHA256

8a014bdbdf86f6c08f6c95a443b084473828f34ee1257b64a033619d0185ab97
SHA512

218102935ef5776f56731287808dd5b2a2f81f7b9842ace7809fa4dc54f5b5cede58d90eb0e59eebe96c40570ce0738bf55389cd1ee2251d86ff1731b12e15fe
SSDEEP

768:4wdkKxp9TlXtq3Ody6oEFV9Aor38kKr05gMqzvAOQYebW7I2rqSI53l5oH:6ibXt1VVzr3hQ0GXsOPekK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2080	2672	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2080	2672	36886c92a7d205d37d4dcf6450a86473.exe	28
PID 2672 wrote to memory of 2080	2672	36886c92a7d205d37d4dcf6450a86473.exe	28
PID 2672 wrote to memory of 2080	2672	36886c92a7d205d37d4dcf6450a86473.exe	28
PID 2672 wrote to memory of 2080	2672	36886c92a7d205d37d4dcf6450a86473.exe	28

C:\Users\Admin\AppData\Local\Temp\36886c92a7d205d37d4dcf6450a86473.exe
"C:\Users\Admin\AppData\Local\Temp\36886c92a7d205d37d4dcf6450a86473.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 88
  2⤵
  - Program crash
  PID:2080

memory/2672-0-0x0000000044440000-0x0000000044454000-memory.dmp

Filesize
80KB

Download