c308d1f92222e8c43464f25d6cb329f9c320fbecbee5327bbfc7cefababe3d23

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 02:05

Target

57b3cd98ef47646cc27e8ac123776043.exe
Size

422KB
MD5

57b3cd98ef47646cc27e8ac123776043
SHA1

a26e74ffdff1f9b0de6fe58b48162f46cdc99130
SHA256

c308d1f92222e8c43464f25d6cb329f9c320fbecbee5327bbfc7cefababe3d23
SHA512

1763a38025762cf341f244c939de057af8e1963973ce24ba45c53a4ccffa205fc9f07661dc100c57b1a83dc7292a06270af4dba4aecbdc216b4190f091b522e5
SSDEEP

6144:ykB1INZdWaFzaE7mDGg7Y4+MFyBPys80G5sEOi9Ri9na5UVx3:ykBgdW/E7mDGg8xMkBp80GiZa5UVh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1944	2964	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 1944	2964	57b3cd98ef47646cc27e8ac123776043.exe	28
PID 2964 wrote to memory of 1944	2964	57b3cd98ef47646cc27e8ac123776043.exe	28
PID 2964 wrote to memory of 1944	2964	57b3cd98ef47646cc27e8ac123776043.exe	28
PID 2964 wrote to memory of 1944	2964	57b3cd98ef47646cc27e8ac123776043.exe	28

C:\Users\Admin\AppData\Local\Temp\57b3cd98ef47646cc27e8ac123776043.exe
"C:\Users\Admin\AppData\Local\Temp\57b3cd98ef47646cc27e8ac123776043.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 116
  2⤵
  - Program crash
  PID:1944

memory/2964-0-0x0000000000100000-0x000000000016E000-memory.dmp

Filesize
440KB

Download