56f7746e1fbca694d89388560f888784c0e188de7545916b318bc20b97b7d987

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 18:51

Target

3ac98a711debe9b0e26e102e174fcff8.exe
Size

5KB
MD5

3ac98a711debe9b0e26e102e174fcff8
SHA1

17c0eb70cd2440e5ce9e1b9d81fdfc142fab867c
SHA256

56f7746e1fbca694d89388560f888784c0e188de7545916b318bc20b97b7d987
SHA512

91e706182b9eb2547fa50f26599705fd7df0a5e2657de022164ea37f26d6ad86b33a89c5f13413fcc616788b8559ea313e657b1bb6bbf70131f5c09c41603b68
SSDEEP

48:CIf7hAxI85zJ4sYpXnxnpnw4PsI2jXLRWo2dfdEnC/oVeIgHeIceo7Uoyl1:D1a15l4sYpXxpnr2F2divZO27Uoyn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2216	2932	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2216	2932	3ac98a711debe9b0e26e102e174fcff8.exe	14
PID 2932 wrote to memory of 2216	2932	3ac98a711debe9b0e26e102e174fcff8.exe	14
PID 2932 wrote to memory of 2216	2932	3ac98a711debe9b0e26e102e174fcff8.exe	14
PID 2932 wrote to memory of 2216	2932	3ac98a711debe9b0e26e102e174fcff8.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 36
1⤵
- Program crash
PID:2216

C:\Users\Admin\AppData\Local\Temp\3ac98a711debe9b0e26e102e174fcff8.exe
"C:\Users\Admin\AppData\Local\Temp\3ac98a711debe9b0e26e102e174fcff8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2932

memory/2932-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download