616cf709fdc6846465235c140fa7357fb63020d0c8e0d978dd29f80bd740948e

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 00:37

Target

52104df03690c119f77c4a1015ad9061.exe
Size

25KB
MD5

52104df03690c119f77c4a1015ad9061
SHA1

d55d7ec0e6564ae27d1fc91f7c4a1c796917525c
SHA256

616cf709fdc6846465235c140fa7357fb63020d0c8e0d978dd29f80bd740948e
SHA512

2c03873d7a631acdc47a659647554cdd7d1769895982e63c03683867c7aca190f0deb2ca0efa0c0f612055c68527ec08d1e7ec99e07c7f8663a3805951f27471
SSDEEP

384:TUmKnSZYRuVh7f0EYw+BrkylhOLX4+l6BU0NTy93SKUG:nuSZwuLD0xw3qOLo/lTyM7G

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2052	2060	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2052	2060	52104df03690c119f77c4a1015ad9061.exe	16
PID 2060 wrote to memory of 2052	2060	52104df03690c119f77c4a1015ad9061.exe	16
PID 2060 wrote to memory of 2052	2060	52104df03690c119f77c4a1015ad9061.exe	16
PID 2060 wrote to memory of 2052	2060	52104df03690c119f77c4a1015ad9061.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 136
1⤵
- Program crash
PID:2052

C:\Users\Admin\AppData\Local\Temp\52104df03690c119f77c4a1015ad9061.exe
"C:\Users\Admin\AppData\Local\Temp\52104df03690c119f77c4a1015ad9061.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060