caba116ebdaebedcd2a2ebc44f85b64e469d8d0f87cff023cae0789492004206

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-01-2024 02:19

Target

57babd99dfbf6248640d5eae61f88458.exe
Size

51KB
MD5

57babd99dfbf6248640d5eae61f88458
SHA1

34bd8eed2215cca362a31a1e0ae3f434d2a34aa0
SHA256

caba116ebdaebedcd2a2ebc44f85b64e469d8d0f87cff023cae0789492004206
SHA512

196bac3c92129987790abed041dc23f61d48bf1c81436473a0e7ebcabd7bfd060718fe1cb8967694cfcd931b4b78c558fd5508c15fc80d01f4007a62607276fb
SSDEEP

768:pI07zQ0IAtXXAGmAo/8ceBi4d3IalnPZk/Lpd1JCmXrz4UwtlWhwlpdtgSS:pIsjIIHRo/JeBi4JdGpgGhj+pgSS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2308	1656	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2308	1656	57babd99dfbf6248640d5eae61f88458.exe	15
PID 1656 wrote to memory of 2308	1656	57babd99dfbf6248640d5eae61f88458.exe	15
PID 1656 wrote to memory of 2308	1656	57babd99dfbf6248640d5eae61f88458.exe	15
PID 1656 wrote to memory of 2308	1656	57babd99dfbf6248640d5eae61f88458.exe	15

C:\Users\Admin\AppData\Local\Temp\57babd99dfbf6248640d5eae61f88458.exe
"C:\Users\Admin\AppData\Local\Temp\57babd99dfbf6248640d5eae61f88458.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 88
  2⤵
  - Program crash
  PID:2308