e2e38cecf97dcc3c57e17ad7d766d4a2208d36f6057537724d0e2f4e54fe970c

Analysis

max time kernel
119s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 14:39

Target

3a176f916467074e875d7e604b608159.exe
Size

115KB
MD5

3a176f916467074e875d7e604b608159
SHA1

7411f10e5adddc15b9c2d3d30708c2d31742dc8e
SHA256

e2e38cecf97dcc3c57e17ad7d766d4a2208d36f6057537724d0e2f4e54fe970c
SHA512

b36a86ffc444314d362c57cac256f2656aa02871919596eee8933b315b3bf426695d0d45246075c763a0246b1fc91da27b62d20ae1ae1789728711320b30a5de
SSDEEP

3072:Qs1jeFBrSwDPiTn0dYpT3/opoUYrHaP9VrBSqKj06p:Bh+BrSmPWTAuUu6PnrFc0K

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2832	2472	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2832	2472	3a176f916467074e875d7e604b608159.exe	28
PID 2472 wrote to memory of 2832	2472	3a176f916467074e875d7e604b608159.exe	28
PID 2472 wrote to memory of 2832	2472	3a176f916467074e875d7e604b608159.exe	28
PID 2472 wrote to memory of 2832	2472	3a176f916467074e875d7e604b608159.exe	28

C:\Users\Admin\AppData\Local\Temp\3a176f916467074e875d7e604b608159.exe
"C:\Users\Admin\AppData\Local\Temp\3a176f916467074e875d7e604b608159.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 36
  2⤵
  - Program crash
  PID:2832

memory/2472-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2472-1-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download