e5463c04b7c6422f7810a411a834dc6249252032a4b4f969ae5123fed7dadd30

Analysis

max time kernel
122s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 15:52

Target

3a6b27efd0027239384162f3fb305211.exe
Size

15KB
MD5

3a6b27efd0027239384162f3fb305211
SHA1

c62df3b1ad7da23e235a904f5ac515cb25b90ec8
SHA256

e5463c04b7c6422f7810a411a834dc6249252032a4b4f969ae5123fed7dadd30
SHA512

cab66eab9b954d4a697d485e0de04c044a1b24ece0c654047d3d516f3dd228328191fef22230a9f5f384a7e177c24825e6f574f0df7a6845968f61c780cef4be
SSDEEP

192:NWYV1aDu998pxfJGIr+lOUWeLyNDgYhA+JPkIMKhosJGpwBW3mhN+TcEOrubox91:NWJm6L09ODgYhA+0KWSWdFOqUDj2whwk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2732	1276	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 2732	1276	3a6b27efd0027239384162f3fb305211.exe	27
PID 1276 wrote to memory of 2732	1276	3a6b27efd0027239384162f3fb305211.exe	27
PID 1276 wrote to memory of 2732	1276	3a6b27efd0027239384162f3fb305211.exe	27
PID 1276 wrote to memory of 2732	1276	3a6b27efd0027239384162f3fb305211.exe	27

C:\Users\Admin\AppData\Local\Temp\3a6b27efd0027239384162f3fb305211.exe
"C:\Users\Admin\AppData\Local\Temp\3a6b27efd0027239384162f3fb305211.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 36
  2⤵
  - Program crash
  PID:2732