ba5c60bb6203a5027a41ccf84d976c432819733abac3862187a17bc47c11ff5e

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 04:42

Target

3fec8d01cb7f91709e6692f504081641.exe
Size

6KB
MD5

3fec8d01cb7f91709e6692f504081641
SHA1

1202ed7cd198d5072a8afc57f079a40e4de6f889
SHA256

ba5c60bb6203a5027a41ccf84d976c432819733abac3862187a17bc47c11ff5e
SHA512

6707e9e2edbe0eb5c691db19cd15507ca0b0fab775857b953d126ad9eca0051e547ed16915ea49a4e9c2c6275e1124575dcab10e65552ecff5a8d1acd4e6fd90
SSDEEP

192:/sUDAeMLRlGYn1FV8rxp9DzgVXheh76YxtiWT9NmyEX6:0UfMzG2POn9o27vPmyEX6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2980	2512	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2980	2512	3fec8d01cb7f91709e6692f504081641.exe	28
PID 2512 wrote to memory of 2980	2512	3fec8d01cb7f91709e6692f504081641.exe	28
PID 2512 wrote to memory of 2980	2512	3fec8d01cb7f91709e6692f504081641.exe	28
PID 2512 wrote to memory of 2980	2512	3fec8d01cb7f91709e6692f504081641.exe	28

C:\Users\Admin\AppData\Local\Temp\3fec8d01cb7f91709e6692f504081641.exe
"C:\Users\Admin\AppData\Local\Temp\3fec8d01cb7f91709e6692f504081641.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 92
  2⤵
  - Program crash
  PID:2980

memory/2512-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2512-1-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download