0e05af5c3eacd033e08e0d72e32663dd6d942ee13e990dcb795b29aeff651a89

Analysis

max time kernel
121s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 13:46

Target

38912780e3c91a421c0b6677f7c5dbe3.exe
Size

3.0MB
MD5

38912780e3c91a421c0b6677f7c5dbe3
SHA1

9ca847c0735cecc3c30e2e7eff681bd0aaef6d26
SHA256

0e05af5c3eacd033e08e0d72e32663dd6d942ee13e990dcb795b29aeff651a89
SHA512

b44fc6f686bdffe930e2c39e6a21239990c412294e15289dd7f0bbcb3b5887663e94c4f940c89989604a6dc23350ca699ff181de07934b9e361b424d75429075
SSDEEP

24576:Ne7QuSOna6sIFq+Hwf+uevwoEAI8k0E/h2D4ThNy1SWiWd7WK:EzLaclQmuev/FI85m2E3IPiIn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2696	2636	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2696	2636	38912780e3c91a421c0b6677f7c5dbe3.exe	28
PID 2636 wrote to memory of 2696	2636	38912780e3c91a421c0b6677f7c5dbe3.exe	28
PID 2636 wrote to memory of 2696	2636	38912780e3c91a421c0b6677f7c5dbe3.exe	28
PID 2636 wrote to memory of 2696	2636	38912780e3c91a421c0b6677f7c5dbe3.exe	28

C:\Users\Admin\AppData\Local\Temp\38912780e3c91a421c0b6677f7c5dbe3.exe
"C:\Users\Admin\AppData\Local\Temp\38912780e3c91a421c0b6677f7c5dbe3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 36
  2⤵
  - Program crash
  PID:2696

memory/2636-0-0x0000000000500000-0x000000000080D000-memory.dmp

Filesize
3.1MB

Download