2444ab84848713035d8a91442230b23680b26720e0c96245429c1ffb13f2f492

Analysis

max time kernel
122s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 14:15

Target

39785ee2e7a80300b2a91da82f5dd30a.exe
Size

283KB
MD5

39785ee2e7a80300b2a91da82f5dd30a
SHA1

ce109a7266e3a09dbf06b2ca42b4c3d21c19b2c5
SHA256

2444ab84848713035d8a91442230b23680b26720e0c96245429c1ffb13f2f492
SHA512

f5eb0d69edab376f8919b32abf1ed9d9d795e2bf0bbe2aed7cd82505751ba64b09516a7042c6b4d5ba9ee440d18204ca03700a105df9106e69bdee7229eec768
SSDEEP

3072:K2/q5o5Kc/opbeQYXrpnadY5eTTa6KZXbj4daNdjgZ/gRHqvN6RnD3YmgzXGVZM:Bqdcgp9mYYouP4daHjbKcpDoRGnM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2684	1956	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2684	1956	39785ee2e7a80300b2a91da82f5dd30a.exe	28
PID 1956 wrote to memory of 2684	1956	39785ee2e7a80300b2a91da82f5dd30a.exe	28
PID 1956 wrote to memory of 2684	1956	39785ee2e7a80300b2a91da82f5dd30a.exe	28
PID 1956 wrote to memory of 2684	1956	39785ee2e7a80300b2a91da82f5dd30a.exe	28

C:\Users\Admin\AppData\Local\Temp\39785ee2e7a80300b2a91da82f5dd30a.exe
"C:\Users\Admin\AppData\Local\Temp\39785ee2e7a80300b2a91da82f5dd30a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 120
  2⤵
  - Program crash
  PID:2684

memory/1956-0-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download