6ab01a8745cde02e6a5211089094410dfcf60035cdbd96eab2cedbc164e54c42

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 11:15

Target

3cb3a833738bb7d8e7d4793de4e486e3.exe
Size

57KB
MD5

3cb3a833738bb7d8e7d4793de4e486e3
SHA1

b50d00f8f1f507b2098d3da163fdb765782e1faa
SHA256

6ab01a8745cde02e6a5211089094410dfcf60035cdbd96eab2cedbc164e54c42
SHA512

04ae97cbe901a9c34a529b5b7ed65c846234895a34f6ada1e14eab5d1b69e6507b660e804f0f004de59a015259d83d612942088dae24c7379f8609cd83e1d878
SSDEEP

768:HdSsNx2tnxkztM0BdDMdpd5P9EUulCNBMGvmAIWo+LUbS0cq/9uJjjgyTE6i+Tkd:5x2tn85MfSUiCzMOLU+Vjsybg1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2676	1220	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2676	1220	3cb3a833738bb7d8e7d4793de4e486e3.exe	28
PID 1220 wrote to memory of 2676	1220	3cb3a833738bb7d8e7d4793de4e486e3.exe	28
PID 1220 wrote to memory of 2676	1220	3cb3a833738bb7d8e7d4793de4e486e3.exe	28
PID 1220 wrote to memory of 2676	1220	3cb3a833738bb7d8e7d4793de4e486e3.exe	28

C:\Users\Admin\AppData\Local\Temp\3cb3a833738bb7d8e7d4793de4e486e3.exe
"C:\Users\Admin\AppData\Local\Temp\3cb3a833738bb7d8e7d4793de4e486e3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 88
  2⤵
  - Program crash
  PID:2676

memory/1220-0-0x0000000000400000-0x000000000040F4A9-memory.dmp

Filesize
61KB

Download
memory/1220-1-0x0000000000400000-0x000000000040F4A9-memory.dmp

Filesize
61KB

Download