32a0c4587b4300a41bb4895414168f2da7de313aac05272fa276b9adda07b8bb

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 05:44

Target

3c0aaaec5fa5ba40e5f933a051829eab.exe
Size

147KB
MD5

3c0aaaec5fa5ba40e5f933a051829eab
SHA1

011077460b31c710ead695dbfcbc6ac5733a28de
SHA256

32a0c4587b4300a41bb4895414168f2da7de313aac05272fa276b9adda07b8bb
SHA512

ae2e07817a3576a5e07943d0f997e62eaf85a6dea92dcc506237127dc77dd2bdfb9de3612f3fbee4101525390f595c87632afa37af644d82dea8200b7567f5ff
SSDEEP

3072:82dJ2y9GCixslC1O9j11IRyFzj9lVcExji695K/0XpxCwE:82dJ2y9GCixs99j11IRyFzxv5xjpnk0K

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
1896	2360	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1896	2360	3c0aaaec5fa5ba40e5f933a051829eab.exe	16
PID 2360 wrote to memory of 1896	2360	3c0aaaec5fa5ba40e5f933a051829eab.exe	16
PID 2360 wrote to memory of 1896	2360	3c0aaaec5fa5ba40e5f933a051829eab.exe	16
PID 2360 wrote to memory of 1896	2360	3c0aaaec5fa5ba40e5f933a051829eab.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 44
1⤵
- Program crash
PID:1896

C:\Users\Admin\AppData\Local\Temp\3c0aaaec5fa5ba40e5f933a051829eab.exe
"C:\Users\Admin\AppData\Local\Temp\3c0aaaec5fa5ba40e5f933a051829eab.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360

memory/2360-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download