359307d362c01c60ec6683dbf60f0d979be761880b2ab19ee1306e83258d3543

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 10:53

Target

3ca90496c33d863ac3e5f76a38df9367.exe
Size

76KB
MD5

3ca90496c33d863ac3e5f76a38df9367
SHA1

2bd6ee70a1474253cf19a35e71e9fa534e6c1efe
SHA256

359307d362c01c60ec6683dbf60f0d979be761880b2ab19ee1306e83258d3543
SHA512

e6672eebc05fdb9b651d3e34d64f901c68a5ff88199aaa3ab1d127a207afac9bdbff65f58349dbcd86bb325d6ad5a0f9d963f8dd0277076ada51386444676802
SSDEEP

1536:i66IRXx8k7zKWlo/1wVC9d0cTv9WXwJXbHJPpjVrs2ryrd1vUQuq6:SHkXKxSVC99v9WSPHs2qo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1800	2540	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 1800	2540	3ca90496c33d863ac3e5f76a38df9367.exe	15
PID 2540 wrote to memory of 1800	2540	3ca90496c33d863ac3e5f76a38df9367.exe	15
PID 2540 wrote to memory of 1800	2540	3ca90496c33d863ac3e5f76a38df9367.exe	15
PID 2540 wrote to memory of 1800	2540	3ca90496c33d863ac3e5f76a38df9367.exe	15

C:\Users\Admin\AppData\Local\Temp\3ca90496c33d863ac3e5f76a38df9367.exe
"C:\Users\Admin\AppData\Local\Temp\3ca90496c33d863ac3e5f76a38df9367.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 36
  2⤵
  - Program crash
  PID:1800

memory/2540-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download