5075c13d66bf5b2e7b8600e3200a1a102b442c5410c63ee3173adf50389efdb3

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 01:30

Target

3b8bf6f4c976f45292e20a3dc746e3b4.exe
Size

25KB
MD5

3b8bf6f4c976f45292e20a3dc746e3b4
SHA1

1528723a957b0f5a1961e3942c8d2cabc4024017
SHA256

5075c13d66bf5b2e7b8600e3200a1a102b442c5410c63ee3173adf50389efdb3
SHA512

064b12e53b5c3c6be06fd9223456b075f3cf191bd85ad95dad4fe52203de624d6681819298055c70a10bfdf78abb24780df423bb5f319b2ee8864f8b6a13fde4
SSDEEP

384:R1fLTw0qt4Q3daLqZnsjD71KHUI+fI6EokRsbgPxfzX5TOJcvuV0xz:3T1qtawsxqeIubOTOJUks

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1784	2956	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 1784	2956	3b8bf6f4c976f45292e20a3dc746e3b4.exe	28
PID 2956 wrote to memory of 1784	2956	3b8bf6f4c976f45292e20a3dc746e3b4.exe	28
PID 2956 wrote to memory of 1784	2956	3b8bf6f4c976f45292e20a3dc746e3b4.exe	28
PID 2956 wrote to memory of 1784	2956	3b8bf6f4c976f45292e20a3dc746e3b4.exe	28

C:\Users\Admin\AppData\Local\Temp\3b8bf6f4c976f45292e20a3dc746e3b4.exe
"C:\Users\Admin\AppData\Local\Temp\3b8bf6f4c976f45292e20a3dc746e3b4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 116
  2⤵
  - Program crash
  PID:1784

memory/2956-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2956-1-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download