688a826f96e17f76f5c658489c208625df996264be08c638746f8782bfa5d4e3

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-01-2024 04:00

Target

57ecaaacaac64515094e34607ac88fc8.exe
Size

393KB
MD5

57ecaaacaac64515094e34607ac88fc8
SHA1

649efaf37409597637b86552f226e8799f469417
SHA256

688a826f96e17f76f5c658489c208625df996264be08c638746f8782bfa5d4e3
SHA512

de0ca1ada9bd181acf5c485e7da0c017c7051c4b730bc218e6c6711542046d1438f9f025085c924ef14090c9cd646ac7d595b0f319d47d46aaa1e820518911f0
SSDEEP

3072:vmi8ukKzkNiKGvFZh15/khgPnb0IEYgcX0X8N2nE4/62lCbKT:vmi8Jlib/h3cib0er462lCbKT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2672	2348	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2672	2348	57ecaaacaac64515094e34607ac88fc8.exe	28
PID 2348 wrote to memory of 2672	2348	57ecaaacaac64515094e34607ac88fc8.exe	28
PID 2348 wrote to memory of 2672	2348	57ecaaacaac64515094e34607ac88fc8.exe	28
PID 2348 wrote to memory of 2672	2348	57ecaaacaac64515094e34607ac88fc8.exe	28

C:\Users\Admin\AppData\Local\Temp\57ecaaacaac64515094e34607ac88fc8.exe
"C:\Users\Admin\AppData\Local\Temp\57ecaaacaac64515094e34607ac88fc8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 36
  2⤵
  - Program crash
  PID:2672

memory/2348-0-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download