57845694c795028a5de6b97f4784bbf0d964f1434dcc0ddc4fb6518faeecb052

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 06:10

Target

3c16c55970870228a78f1463af24d5b4.exe
Size

48KB
MD5

3c16c55970870228a78f1463af24d5b4
SHA1

f962a51a6952047bbc56663b08cfce915d71721e
SHA256

57845694c795028a5de6b97f4784bbf0d964f1434dcc0ddc4fb6518faeecb052
SHA512

fc6ee11cb20adc449613ce5a3dc53d0b0e2294aebccd77ce7a812b92e1b6533e9be8fd14369eaca353d3b7572053c6ff117d60f7dd2640e17262063821951070
SSDEEP

768:VWVnOHI0CVmTy+aXkugEp5IulRZcAoIiZt2YqbdgI9JnP:VWJ02m++NugEpHlsAxD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2540	2184	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2540	2184	3c16c55970870228a78f1463af24d5b4.exe	28
PID 2184 wrote to memory of 2540	2184	3c16c55970870228a78f1463af24d5b4.exe	28
PID 2184 wrote to memory of 2540	2184	3c16c55970870228a78f1463af24d5b4.exe	28
PID 2184 wrote to memory of 2540	2184	3c16c55970870228a78f1463af24d5b4.exe	28

C:\Users\Admin\AppData\Local\Temp\3c16c55970870228a78f1463af24d5b4.exe
"C:\Users\Admin\AppData\Local\Temp\3c16c55970870228a78f1463af24d5b4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 136
  2⤵
  - Program crash
  PID:2540

memory/2184-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download