5ea2e610d4cab87581ceec2ea2724bd03a8a2f0de3a4f687d4087fc37dd795e0

Analysis

max time kernel
142s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 01:00

Target

3b83826f9404ba991f665e610e919394.exe
Size

361KB
MD5

3b83826f9404ba991f665e610e919394
SHA1

e42d97afa86021875f87cee1d5bafd475c5b7474
SHA256

5ea2e610d4cab87581ceec2ea2724bd03a8a2f0de3a4f687d4087fc37dd795e0
SHA512

234db26d6a285251c4abd59822bec57412c8445848ea978846bfb7e49433690a1d0d372befabd4a38f4b5cc084c84b3c4f9152db11f4e27b815087597160b085
SSDEEP

6144:wGVPyyMHVilE0LiywLf+llnmPf6BSqHm+Ihx4iwiwjgI7DKyVSHK8q:JM1ilhQb+l0P2mNhqiwUKm8SH4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3056	1940	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 3056	1940	3b83826f9404ba991f665e610e919394.exe	28
PID 1940 wrote to memory of 3056	1940	3b83826f9404ba991f665e610e919394.exe	28
PID 1940 wrote to memory of 3056	1940	3b83826f9404ba991f665e610e919394.exe	28
PID 1940 wrote to memory of 3056	1940	3b83826f9404ba991f665e610e919394.exe	28

C:\Users\Admin\AppData\Local\Temp\3b83826f9404ba991f665e610e919394.exe
"C:\Users\Admin\AppData\Local\Temp\3b83826f9404ba991f665e610e919394.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 144
  2⤵
  - Program crash
  PID:3056

memory/1940-2-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download