6ddc0fbd70a7ee274b7bc5c3029835d59ce50ebb82138c861be2b19d9f1e75f1

Analysis

max time kernel
122s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 16:51

Target

3a8fdf23354ae0b891e007331e997e0d.exe
Size

174KB
MD5

3a8fdf23354ae0b891e007331e997e0d
SHA1

99c609b53ecee729c1271aafc5c96583f4d8a328
SHA256

6ddc0fbd70a7ee274b7bc5c3029835d59ce50ebb82138c861be2b19d9f1e75f1
SHA512

d6a0d22f66cad889465461932d677161acdb96b672dcf0b5c8949074856bc970d151d03d52b85fe734251d0774ad4761268f1ee6ce5bc5169187183fcdaf6e86
SSDEEP

3072:1pzRNYuluupWyvbOijh7UAoaI52pySvl3nW0CWcscGF8ZHmt4qaz7:1ZRvupm9UX5WflXW5Wc88wGnz7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1652	2540	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 1652	2540	3a8fdf23354ae0b891e007331e997e0d.exe	28
PID 2540 wrote to memory of 1652	2540	3a8fdf23354ae0b891e007331e997e0d.exe	28
PID 2540 wrote to memory of 1652	2540	3a8fdf23354ae0b891e007331e997e0d.exe	28
PID 2540 wrote to memory of 1652	2540	3a8fdf23354ae0b891e007331e997e0d.exe	28

C:\Users\Admin\AppData\Local\Temp\3a8fdf23354ae0b891e007331e997e0d.exe
"C:\Users\Admin\AppData\Local\Temp\3a8fdf23354ae0b891e007331e997e0d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 96
  2⤵
  - Program crash
  PID:1652