3d330bc7103b4a66563e65400d11adea1b080bda1ffa060ed7e2d6e652af015d

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 12:02

Target

5b30e1dc06db045405718804ebd25333.exe
Size

123KB
MD5

5b30e1dc06db045405718804ebd25333
SHA1

6e249a9b69f77071ae723a6a1e61b619012811e1
SHA256

3d330bc7103b4a66563e65400d11adea1b080bda1ffa060ed7e2d6e652af015d
SHA512

089df4bb18c6967f5abf6a4ffb159bcf781efe8a36fe4fbf3518d48d3b96f2972eb4eed988e0282b6a3bb54ad8635ad8c91f1c12b5ff75ff6859f9af32e2a5f0
SSDEEP

3072:rtUQzdFO2wHrShNrwUn21riUEzJzH1LjPeFo1zsdjcoYR1:BUQzdFwHrShNcC0riUkzHUFuzsdoBT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1220	2088	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1220	2088	5b30e1dc06db045405718804ebd25333.exe	28
PID 2088 wrote to memory of 1220	2088	5b30e1dc06db045405718804ebd25333.exe	28
PID 2088 wrote to memory of 1220	2088	5b30e1dc06db045405718804ebd25333.exe	28
PID 2088 wrote to memory of 1220	2088	5b30e1dc06db045405718804ebd25333.exe	28

C:\Users\Admin\AppData\Local\Temp\5b30e1dc06db045405718804ebd25333.exe
"C:\Users\Admin\AppData\Local\Temp\5b30e1dc06db045405718804ebd25333.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 36
  2⤵
  - Program crash
  PID:1220

memory/2088-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2088-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download