cb6498cb56a096081d878f72d94cc025faca1dbacd31f0c9d84fc1b6b4e176bb

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15-01-2024 01:26

Target

5bc68c6b8ce3afa22e67e2bc43b242fd.exe
Size

107KB
MD5

5bc68c6b8ce3afa22e67e2bc43b242fd
SHA1

4cd8f6e1fdb3b2ff6bdb42f0c74f4ac780869d7e
SHA256

cb6498cb56a096081d878f72d94cc025faca1dbacd31f0c9d84fc1b6b4e176bb
SHA512

6c40d68fbb782a83675dd252424399de471e06ce50d738d8db547198612150fa6e257ef055edd5640a50ca0a60a7672f7828d5f9914900d58287366a2e4c8195
SSDEEP

1536:5L/eV0oohJlHH05ndYcW60T6hcZvRdf7Wwt8dPi9qH1HWux6JBPEY+41cJ:8Va/H0LY/Rmhudf7hAZH12ux6/8O+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2780	2672	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2780	2672	5bc68c6b8ce3afa22e67e2bc43b242fd.exe	28
PID 2672 wrote to memory of 2780	2672	5bc68c6b8ce3afa22e67e2bc43b242fd.exe	28
PID 2672 wrote to memory of 2780	2672	5bc68c6b8ce3afa22e67e2bc43b242fd.exe	28
PID 2672 wrote to memory of 2780	2672	5bc68c6b8ce3afa22e67e2bc43b242fd.exe	28

C:\Users\Admin\AppData\Local\Temp\5bc68c6b8ce3afa22e67e2bc43b242fd.exe
"C:\Users\Admin\AppData\Local\Temp\5bc68c6b8ce3afa22e67e2bc43b242fd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 160
  2⤵
  - Program crash
  PID:2780

memory/2672-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2672-1-0x00000000003A0000-0x00000000003D0000-memory.dmp

Filesize
192KB

Download
memory/2672-2-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2672-3-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2672-4-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download