d8b811d0ecd1a8dc8b819e43262bcab738f7a691800af881c55c21a290ef7fc5

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 02:09

Target

553339be60e6652d644e544971a5cab6.exe
Size

123KB
MD5

553339be60e6652d644e544971a5cab6
SHA1

70759eeb5a009593099ba3cf75d2a33f42b7e96f
SHA256

d8b811d0ecd1a8dc8b819e43262bcab738f7a691800af881c55c21a290ef7fc5
SHA512

9174c724a7510eec441267bb3d79c11f3248f8dd2b143c753d19964f79fb7241f82fc636f9a02d950bf262fb5e35fb1b4feef1ecb8495795b1f8bf638630ee2f
SSDEEP

1536:91d7pvItcnRmvnukUwEWdNyXj4iSUwv5WVTPfdlWEuEeLxeo5QIiZcI3CFgPRZb1:91XwtcYv+2NyXE4w4TjWEuEeLjJjgv5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2956	2888	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2956	2888	553339be60e6652d644e544971a5cab6.exe	28
PID 2888 wrote to memory of 2956	2888	553339be60e6652d644e544971a5cab6.exe	28
PID 2888 wrote to memory of 2956	2888	553339be60e6652d644e544971a5cab6.exe	28
PID 2888 wrote to memory of 2956	2888	553339be60e6652d644e544971a5cab6.exe	28

C:\Users\Admin\AppData\Local\Temp\553339be60e6652d644e544971a5cab6.exe
"C:\Users\Admin\AppData\Local\Temp\553339be60e6652d644e544971a5cab6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 36
  2⤵
  - Program crash
  PID:2956

memory/2888-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2888-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download