5181a6d5accc4b6277185bcb0229efb80e426a42936a5880fc16134bf099889a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 01:23

Target

579e0f9b3896313fecdf9379838d3956.exe
Size

44KB
MD5

579e0f9b3896313fecdf9379838d3956
SHA1

cadcdcf6ae83fd288e15ca99444bd6f61c14e2c0
SHA256

5181a6d5accc4b6277185bcb0229efb80e426a42936a5880fc16134bf099889a
SHA512

dc75cca081c319dde3893551e7fe6c1e07032b8a6c2857213b70c797c8b77db178cb03a95fc059e51750994b8eca3f08ee33cc1fbd8664685f6e37e4338e4168
SSDEEP

384:BepSzij5nFa8XD2W9eGSrLcdoZY2mzOb/Lh6sqFrLnTKzSm/CCREyXFInhGjP62c:BxI5FlXD22AQCHQB+z7aFvAjP6avoNFT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2180	1340	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 2180	1340	579e0f9b3896313fecdf9379838d3956.exe	14
PID 1340 wrote to memory of 2180	1340	579e0f9b3896313fecdf9379838d3956.exe	14
PID 1340 wrote to memory of 2180	1340	579e0f9b3896313fecdf9379838d3956.exe	14
PID 1340 wrote to memory of 2180	1340	579e0f9b3896313fecdf9379838d3956.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 76
1⤵
- Program crash
PID:2180

C:\Users\Admin\AppData\Local\Temp\579e0f9b3896313fecdf9379838d3956.exe
"C:\Users\Admin\AppData\Local\Temp\579e0f9b3896313fecdf9379838d3956.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1340