060be6d96922638064f6d97ab92675dd54cff6609c1b8dd08c0b86bf8e6b28ad

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 13:09

Target

539aba7e7bba0b6a764145ed9aed6a86.exe
Size

101KB
MD5

539aba7e7bba0b6a764145ed9aed6a86
SHA1

75dd4e0759ce117da8d5b8e610b824674183de91
SHA256

060be6d96922638064f6d97ab92675dd54cff6609c1b8dd08c0b86bf8e6b28ad
SHA512

ca4be0f8163353606f47d608c311320dc690e71e7f00daedadbb3a98ee91ab43590d716b54e153671c68bec7ad3f9a3d71187989e4e997f3e1a98a7617108bcd
SSDEEP

1536:/7MU5en/7Ws0cA21bHoMwMGBSXFy4YNzw302BlXa5JvRzzRjWQz+RL6hVU:wou0X2ZIv2FNYNzs0YcpB1i

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2948	2756	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2948	2756	539aba7e7bba0b6a764145ed9aed6a86.exe	28
PID 2756 wrote to memory of 2948	2756	539aba7e7bba0b6a764145ed9aed6a86.exe	28
PID 2756 wrote to memory of 2948	2756	539aba7e7bba0b6a764145ed9aed6a86.exe	28
PID 2756 wrote to memory of 2948	2756	539aba7e7bba0b6a764145ed9aed6a86.exe	28

C:\Users\Admin\AppData\Local\Temp\539aba7e7bba0b6a764145ed9aed6a86.exe
"C:\Users\Admin\AppData\Local\Temp\539aba7e7bba0b6a764145ed9aed6a86.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 36
  2⤵
  - Program crash
  PID:2948

memory/2756-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download