7ab450961449cc00d24683c8b2e707fbbd82af35ec6b6e0bd86e08d96e4b2418

Analysis

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 05:10

Target

5a5d544b2147bb4d622db2b845546464.exe
Size

656KB
MD5

5a5d544b2147bb4d622db2b845546464
SHA1

043ac4d41919d541fcf45685bc75f2c4a7f397f2
SHA256

7ab450961449cc00d24683c8b2e707fbbd82af35ec6b6e0bd86e08d96e4b2418
SHA512

4c992bf11a8af065d068a1861a9d6a84c0480542ac333a554b0267a0c99e351f0ea8ea7614c63a118a8fc85a1c9d7e401222ca82ecfd57d6e740e066aa57963b
SSDEEP

12288:JSdjccBUzFXBU1Q5W9NyJTHIAkVtF3Z4mxxgX2Fi0yT8f:0dbLC5WY6tQmXdZyw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2688	2784	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2688	2784	5a5d544b2147bb4d622db2b845546464.exe	28
PID 2784 wrote to memory of 2688	2784	5a5d544b2147bb4d622db2b845546464.exe	28
PID 2784 wrote to memory of 2688	2784	5a5d544b2147bb4d622db2b845546464.exe	28
PID 2784 wrote to memory of 2688	2784	5a5d544b2147bb4d622db2b845546464.exe	28

C:\Users\Admin\AppData\Local\Temp\5a5d544b2147bb4d622db2b845546464.exe
"C:\Users\Admin\AppData\Local\Temp\5a5d544b2147bb4d622db2b845546464.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 224
  2⤵
  - Program crash
  PID:2688

memory/2784-0-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download