8d3abe0465ed767ca69829b4dedf840cf58163c60af52f3016b061b4e4c923fc

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 17:57

Target

5139b2695e9bef33594a3926bd3e22ce.exe
Size

422KB
MD5

5139b2695e9bef33594a3926bd3e22ce
SHA1

ff69af4444f4e7ac2ac4f3dfbbb2e6d82e79f4bd
SHA256

8d3abe0465ed767ca69829b4dedf840cf58163c60af52f3016b061b4e4c923fc
SHA512

25ee500a68bbbbd23d589a59e94bd096309092ba7933c50c172cce0dfdf48d3794da675903f39768ad77bd0d034472935c292c757dc0925ae5a2f3580d6c8f53
SSDEEP

6144:ykB1INZdWaFzaE7mDGg7Y4+MFyBPys80G5sEOi9Ri9na5UVx3:ykBgdW/E7mDGg8xMkBp80GiZa5UVh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1312	2644	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 1312	2644	5139b2695e9bef33594a3926bd3e22ce.exe	28
PID 2644 wrote to memory of 1312	2644	5139b2695e9bef33594a3926bd3e22ce.exe	28
PID 2644 wrote to memory of 1312	2644	5139b2695e9bef33594a3926bd3e22ce.exe	28
PID 2644 wrote to memory of 1312	2644	5139b2695e9bef33594a3926bd3e22ce.exe	28

C:\Users\Admin\AppData\Local\Temp\5139b2695e9bef33594a3926bd3e22ce.exe
"C:\Users\Admin\AppData\Local\Temp\5139b2695e9bef33594a3926bd3e22ce.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 116
  2⤵
  - Program crash
  PID:1312

memory/2644-0-0x0000000000910000-0x000000000097E000-memory.dmp

Filesize
440KB

Download