0428bcbbc530d3a95ca2ae47be2ee2ffbb4fd306d4da28f6b6f8c6d98676d400

Analysis

max time kernel
181s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:23

Target

37ddffd67a5b27c3a302f0aeefcdf019.exe
Size

488KB
MD5

37ddffd67a5b27c3a302f0aeefcdf019
SHA1

765cd9506149bd0369340824f882a4935bdab8d5
SHA256

0428bcbbc530d3a95ca2ae47be2ee2ffbb4fd306d4da28f6b6f8c6d98676d400
SHA512

dc9b071ce7fe3a0c15a77dead6eab5ad4e6e4073a70d2fa161cdf9d8a2d681645173da8604e9cdcbd2a990261263ce54c0304c9d12fe14c8e2a16d9950bb7396
SSDEEP

6144:xAELpOdfzrxCgVYte+iwzF2idZecnl20lHRxp3gI7QVEOYf3LMEtSugjvVc+ag75:/IzrxVYtRi+F3Z4mxxFT3fA0Svb9nKoZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2672	2792	WerFault.exe	3

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2672	2792	37ddffd67a5b27c3a302f0aeefcdf019.exe	29
PID 2792 wrote to memory of 2672	2792	37ddffd67a5b27c3a302f0aeefcdf019.exe	29
PID 2792 wrote to memory of 2672	2792	37ddffd67a5b27c3a302f0aeefcdf019.exe	29
PID 2792 wrote to memory of 2672	2792	37ddffd67a5b27c3a302f0aeefcdf019.exe	29

C:\Users\Admin\AppData\Local\Temp\37ddffd67a5b27c3a302f0aeefcdf019.exe
"C:\Users\Admin\AppData\Local\Temp\37ddffd67a5b27c3a302f0aeefcdf019.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 128
  2⤵
  - Program crash
  PID:2672

memory/2792-0-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/2792-1-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/2792-2-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download