3a54259bf81489c684eed638e7cf7d229f048e504e5e1abc397d21389e8aa9af

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 00:57

Target

3b8205f941be8ca0628258f2053b658d.exe
Size

21KB
MD5

3b8205f941be8ca0628258f2053b658d
SHA1

4a211b4acce93db15b5a25198f1bbfc1f502ca44
SHA256

3a54259bf81489c684eed638e7cf7d229f048e504e5e1abc397d21389e8aa9af
SHA512

659dae396e3274ad5189fe2e46eef8314c84068e51cf92a3f1d75dab06b24406df00b5f21350334a0340b004633366f7a71deed4366e8449a1b6978319e83306
SSDEEP

384:6ZKrJF6w23wziwAlNm4W9/DFwFLFUKe/qjAVXqyFYKZGLCf9ZiWDrHx:k8nbAlNINOFLFUHuiqyFdYLCviWDl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
3000	2980	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 3000	2980	3b8205f941be8ca0628258f2053b658d.exe	14
PID 2980 wrote to memory of 3000	2980	3b8205f941be8ca0628258f2053b658d.exe	14
PID 2980 wrote to memory of 3000	2980	3b8205f941be8ca0628258f2053b658d.exe	14
PID 2980 wrote to memory of 3000	2980	3b8205f941be8ca0628258f2053b658d.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 36
1⤵
- Program crash
PID:3000

C:\Users\Admin\AppData\Local\Temp\3b8205f941be8ca0628258f2053b658d.exe
"C:\Users\Admin\AppData\Local\Temp\3b8205f941be8ca0628258f2053b658d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2980