ad4dec97a7b85ff898dc8ed2d7594f4c03543bbcc1cfbe18cfad54d02db5bd73

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 14:39

Target

3a15fb53e91d2f4f120648656fa1816d.exe
Size

722KB
MD5

3a15fb53e91d2f4f120648656fa1816d
SHA1

c1756f50e49298061694405fdf3d750634c672f8
SHA256

ad4dec97a7b85ff898dc8ed2d7594f4c03543bbcc1cfbe18cfad54d02db5bd73
SHA512

98ab560536fe77bfbd9188c9571a4aac9fa9555126f20b5956dea950b2962ab361f1aea078c1ef61dfdb62fc624a6c3881ef35788e307a4235fc600f6b71aa75
SSDEEP

12288:wTKnxQ0uzZsRAsJKuhMmCabTDti6/iNu4fHm63D8nzRGjdtfuYHOQLuOBF2MYlJ:wT+xQnsRA5uhMmCafRVKlHr3D8zRkt2l

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2256	2540	WerFault.exe	24

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2256	2540	3a15fb53e91d2f4f120648656fa1816d.exe	28
PID 2540 wrote to memory of 2256	2540	3a15fb53e91d2f4f120648656fa1816d.exe	28
PID 2540 wrote to memory of 2256	2540	3a15fb53e91d2f4f120648656fa1816d.exe	28
PID 2540 wrote to memory of 2256	2540	3a15fb53e91d2f4f120648656fa1816d.exe	28

C:\Users\Admin\AppData\Local\Temp\3a15fb53e91d2f4f120648656fa1816d.exe
"C:\Users\Admin\AppData\Local\Temp\3a15fb53e91d2f4f120648656fa1816d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 36
  2⤵
  - Program crash
  PID:2256

memory/2540-0-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download