5b42eb42fcac80f1ed1ec4cb264bfd0a45aa692c75ea24f3a8fb1ad8c335aa17

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15-01-2024 04:35

Target

5c2601734c8d22b0d4c2c0fb785ad209.exe
Size

21KB
MD5

5c2601734c8d22b0d4c2c0fb785ad209
SHA1

e324160d93301298a489cacdafc973fe7d3bbd38
SHA256

5b42eb42fcac80f1ed1ec4cb264bfd0a45aa692c75ea24f3a8fb1ad8c335aa17
SHA512

363a06e02e851fc522de420b026ed38bd52a21271d89b0409268a7e5f665d69c8755b8414585f4c7f7f53aaac16ebf31d9962abbd737cd2b6f1ca36e5b184250
SSDEEP

384:YSlgQcaIoqpDgg7SUse81A6PyU6eDbkUHwq05q0KJGG:Ytg7Ua1A66ADbtQq6q0KJl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
1184	1992	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1184	1992	5c2601734c8d22b0d4c2c0fb785ad209.exe	14
PID 1992 wrote to memory of 1184	1992	5c2601734c8d22b0d4c2c0fb785ad209.exe	14
PID 1992 wrote to memory of 1184	1992	5c2601734c8d22b0d4c2c0fb785ad209.exe	14
PID 1992 wrote to memory of 1184	1992	5c2601734c8d22b0d4c2c0fb785ad209.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 88
1⤵
- Program crash
PID:1184

C:\Users\Admin\AppData\Local\Temp\5c2601734c8d22b0d4c2c0fb785ad209.exe
"C:\Users\Admin\AppData\Local\Temp\5c2601734c8d22b0d4c2c0fb785ad209.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992

memory/1992-0-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download