6956acb924d690bf73a9d02d78b7b08203bcc7ff67a79ac8521139d979fcccda

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 02:01

Target

552f9b8e1943bad18fcc5331bbf3d073.exe
Size

141KB
MD5

552f9b8e1943bad18fcc5331bbf3d073
SHA1

f6910b0f7bd2a1fd93870f55c2a0aa58b3336a28
SHA256

6956acb924d690bf73a9d02d78b7b08203bcc7ff67a79ac8521139d979fcccda
SHA512

8d931713dd054ae62c67f492a1aee0efcb1a0594e0169174f12fd8a468029cee8a5eccac938e42bb9dffafd72df3c5698c8dcf754aed05b8ccb8be25846a6c84
SSDEEP

3072:lbCrnPN1fBkt6/1PkY+8a6ggJKuAYiC1tkmj6ET:5knF1fSt6/1X+JxgA5CtkWf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1756	2252	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1756	2252	552f9b8e1943bad18fcc5331bbf3d073.exe	28
PID 2252 wrote to memory of 1756	2252	552f9b8e1943bad18fcc5331bbf3d073.exe	28
PID 2252 wrote to memory of 1756	2252	552f9b8e1943bad18fcc5331bbf3d073.exe	28
PID 2252 wrote to memory of 1756	2252	552f9b8e1943bad18fcc5331bbf3d073.exe	28

C:\Users\Admin\AppData\Local\Temp\552f9b8e1943bad18fcc5331bbf3d073.exe
"C:\Users\Admin\AppData\Local\Temp\552f9b8e1943bad18fcc5331bbf3d073.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 88
  2⤵
  - Program crash
  PID:1756

memory/2252-2-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2252-0-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2252-5-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2252-4-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2252-3-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download