ab01d5424206a9d784040c8a4c2a18422ab3ccf39e5ce5b55880be5950027bbb

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 15:35

Target

5914096580f77a6adf06b57c300f310b.exe
Size

180KB
MD5

5914096580f77a6adf06b57c300f310b
SHA1

98a750cbf763f6f77242d8e391b7a6fd22043e6b
SHA256

ab01d5424206a9d784040c8a4c2a18422ab3ccf39e5ce5b55880be5950027bbb
SHA512

1d096438a6fdd2c693d64232003f05d0756300e0a65627c5abf709b1bbc644bc13cabb5b295a8341b5f158574e2c38b7cb5503c4b5564561c15a46b880d77cc0
SSDEEP

3072:PFnhBS/SHm8/b+SHiM0CrLISfH0/JPExZk82xvDN4DVxxLb:PFnhtmkb5CM04ISfU/Jcxa86DN6LX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2656	2476	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2656	2476	5914096580f77a6adf06b57c300f310b.exe	21
PID 2476 wrote to memory of 2656	2476	5914096580f77a6adf06b57c300f310b.exe	21
PID 2476 wrote to memory of 2656	2476	5914096580f77a6adf06b57c300f310b.exe	21
PID 2476 wrote to memory of 2656	2476	5914096580f77a6adf06b57c300f310b.exe	21

C:\Users\Admin\AppData\Local\Temp\5914096580f77a6adf06b57c300f310b.exe
"C:\Users\Admin\AppData\Local\Temp\5914096580f77a6adf06b57c300f310b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 84
  2⤵
  - Program crash
  PID:2656