4883d2aaf9a1f4c3433cf32e5f76c27f6b0a3158b094ec4674cae66e0c04ce4c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 17:13

Target

5943997b5a5e9ff4733b5d5a94166316.exe
Size

122KB
MD5

5943997b5a5e9ff4733b5d5a94166316
SHA1

5a89e8963d36f0bc1c4077a4e18ee471ed90684a
SHA256

4883d2aaf9a1f4c3433cf32e5f76c27f6b0a3158b094ec4674cae66e0c04ce4c
SHA512

7ee20a4907a619e009abf03843971addfc8a3871b4da7e3b60fbc1a715dae15a86d2cb707d23bd2ce25994e28f8e87e2a690a6203e4ffe652ff399a6941e0478
SSDEEP

3072:tbSc6GKpDdFDmareVTQjTacnvfc0IziV1:tbg91dFyarNacnHc0ai7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2824	2652	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2824	2652	5943997b5a5e9ff4733b5d5a94166316.exe	28
PID 2652 wrote to memory of 2824	2652	5943997b5a5e9ff4733b5d5a94166316.exe	28
PID 2652 wrote to memory of 2824	2652	5943997b5a5e9ff4733b5d5a94166316.exe	28
PID 2652 wrote to memory of 2824	2652	5943997b5a5e9ff4733b5d5a94166316.exe	28

C:\Users\Admin\AppData\Local\Temp\5943997b5a5e9ff4733b5d5a94166316.exe
"C:\Users\Admin\AppData\Local\Temp\5943997b5a5e9ff4733b5d5a94166316.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 92
  2⤵
  - Program crash
  PID:2824

memory/2652-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2652-3-0x0000000000220000-0x0000000000240000-memory.dmp

Filesize
128KB

Download
memory/2652-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2652-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2652-4-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download