df78a15bed5031f491327e9c12f1a5f1ee5dfec0a4ce5f6f1b81100a5289e608

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 06:30

Target

3c21e1c3ed5161e9b7c36ea925c83c79.exe
Size

150KB
MD5

3c21e1c3ed5161e9b7c36ea925c83c79
SHA1

fd5f6279b4deb021b62214cbd2cd395d3a141042
SHA256

df78a15bed5031f491327e9c12f1a5f1ee5dfec0a4ce5f6f1b81100a5289e608
SHA512

74d5b1aae0fb5f470c09a4c0784567f184de0be25e39f14f7a0cd2796aa66a872026c1fff6809452a4d71b2591ddcc4ffe36befe21798d10e91c121d84261d7a
SSDEEP

3072:YcpjnuRgWu6ZsV5oOoS6HeNlVqkJSm+Ox+vGnLZN34WLV/vJxwxpoHedcu6S:YcJyh3ZsV5oPGNrqkJSm+Ox9LZN34WR4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3068	3024	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 3068	3024	3c21e1c3ed5161e9b7c36ea925c83c79.exe	28
PID 3024 wrote to memory of 3068	3024	3c21e1c3ed5161e9b7c36ea925c83c79.exe	28
PID 3024 wrote to memory of 3068	3024	3c21e1c3ed5161e9b7c36ea925c83c79.exe	28
PID 3024 wrote to memory of 3068	3024	3c21e1c3ed5161e9b7c36ea925c83c79.exe	28

C:\Users\Admin\AppData\Local\Temp\3c21e1c3ed5161e9b7c36ea925c83c79.exe
"C:\Users\Admin\AppData\Local\Temp\3c21e1c3ed5161e9b7c36ea925c83c79.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 36
  2⤵
  - Program crash
  PID:3068

memory/3024-0-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download