f5c7d674e0b22cd2df5d5c0c784482686cd86b494be1e5135cac8830008bc53a

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-01-2024 22:12

Target

598a3c95b7229bc99ed32990306a8451.exe
Size

19KB
MD5

598a3c95b7229bc99ed32990306a8451
SHA1

82230277c522ae5824d8f41327fb9c6301f7bc36
SHA256

f5c7d674e0b22cd2df5d5c0c784482686cd86b494be1e5135cac8830008bc53a
SHA512

9b441eecb3ff23e69c2b7e432bf0d58687fe1a3606da365e72306426bab29ed42381355d76486633f8d41ccda20a2f4d7fa40247d8650c41e3aee7697f1d89fe
SSDEEP

384:WuqxIzFu/68lOAxzD9fezrn49UF4A37lZaNJawcudoD7Uc:WRCFu/rrxzDJezFvrqnbcuyD7U

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2156	2480	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2156	2480	598a3c95b7229bc99ed32990306a8451.exe	28
PID 2480 wrote to memory of 2156	2480	598a3c95b7229bc99ed32990306a8451.exe	28
PID 2480 wrote to memory of 2156	2480	598a3c95b7229bc99ed32990306a8451.exe	28
PID 2480 wrote to memory of 2156	2480	598a3c95b7229bc99ed32990306a8451.exe	28

C:\Users\Admin\AppData\Local\Temp\598a3c95b7229bc99ed32990306a8451.exe
"C:\Users\Admin\AppData\Local\Temp\598a3c95b7229bc99ed32990306a8451.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 136
  2⤵
  - Program crash
  PID:2156

memory/2480-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2480-1-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download