f06c4286ac36187fa1fe691736e6ccc437ded210abb33634402612af3b0b9896

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 10:02

Target

56274c5a5e93e9640847287e14626566.exe
Size

120KB
MD5

56274c5a5e93e9640847287e14626566
SHA1

0aabf047c66c49357bdd862d2f897ff5f0fa76a1
SHA256

f06c4286ac36187fa1fe691736e6ccc437ded210abb33634402612af3b0b9896
SHA512

9b8e8b4492c4ce75705d76b3fb16564a7474cc866575cb01cf443fbeb4bfd68739c0ead1b78a39abeef07426c97536d81379642dbdb9a2471ae16050172e8428
SSDEEP

1536:oDZC4p7T0RGwWk7hYWPyrugNX3jI5Ti7g5DYysV3W1KTqV7pcbuIdr2/ItNa:Eddg8ehYWPyH6i7g5DxsVL2V7pc5drxc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1912	3012	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 1912	3012	56274c5a5e93e9640847287e14626566.exe	28
PID 3012 wrote to memory of 1912	3012	56274c5a5e93e9640847287e14626566.exe	28
PID 3012 wrote to memory of 1912	3012	56274c5a5e93e9640847287e14626566.exe	28
PID 3012 wrote to memory of 1912	3012	56274c5a5e93e9640847287e14626566.exe	28

C:\Users\Admin\AppData\Local\Temp\56274c5a5e93e9640847287e14626566.exe
"C:\Users\Admin\AppData\Local\Temp\56274c5a5e93e9640847287e14626566.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 148
  2⤵
  - Program crash
  PID:1912

memory/3012-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/3012-1-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download