f0e4a2234534ef5b610546834c3dd7752e73cb73dfbfac78e3a305e9dae9c817

Analysis

max time kernel
174s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 13:46

Target

38932d11244dbbdd3ff6ce806a853a19.exe
Size

139KB
MD5

38932d11244dbbdd3ff6ce806a853a19
SHA1

b64bb455104716ea4e9d4e760ca97c4dcc66448e
SHA256

f0e4a2234534ef5b610546834c3dd7752e73cb73dfbfac78e3a305e9dae9c817
SHA512

cb5f2eefbbd88c82bd9f8e54692f306f3ddaba8f7c805b368e1ef7adcb4c268a2a7f09fd7a0634c74693e62ac14f08ce3b0e591f75bef9cdc423a745f9d9d1c4
SSDEEP

3072:NLiElP6ozYZfkfRC9QtdXfJocfl3GgnbPE+QLh4xPWl7BXBJJwDr:NLtB64+f/QtdXfJoAl7bPE7LhSPWl7Bx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2640	2832	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 2640	2832	38932d11244dbbdd3ff6ce806a853a19.exe	29
PID 2832 wrote to memory of 2640	2832	38932d11244dbbdd3ff6ce806a853a19.exe	29
PID 2832 wrote to memory of 2640	2832	38932d11244dbbdd3ff6ce806a853a19.exe	29
PID 2832 wrote to memory of 2640	2832	38932d11244dbbdd3ff6ce806a853a19.exe	29

C:\Users\Admin\AppData\Local\Temp\38932d11244dbbdd3ff6ce806a853a19.exe
"C:\Users\Admin\AppData\Local\Temp\38932d11244dbbdd3ff6ce806a853a19.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 36
  2⤵
  - Program crash
  PID:2640

memory/2832-0-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download