5c7af580a755c6428982c8e3c8ca29efc031d6897e3d8ff91570acdcf3961fe0

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15/01/2024, 04:43

Target
852b8d4d2a9c586f32b54da471082b58.exe
Size 251KB
Sample240115-fb83wsaeb3
SHA256 5c7af580a755c6428982c8e3c8ca29efc031d6897e3d8ff91570acdcf3961fe0
MD5 852b8d4d2a9c586f32b54da471082b58
SHA1 2b4b455bc36ba8c60c058bcc7b7e364652b06bce
SHA512 97cad4e83320ae638ff2fb3eed3eefd6b63ebda8b5b3e671d0d75120cf507bfc555fe386d7322b0db58d15aac5dda8f6e22841d107b75ef0c5e9c4c6eacdbc47
SSDEEP 6144:I7HwxikgLCSyoNwC52gddb3xL1PANRzqHvoUqn:WQBg/FNsgX3t1PFHv
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3008	2216	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2216	852b8d4d2a9c586f32b54da471082b58.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 3008	2216	852b8d4d2a9c586f32b54da471082b58.exe	28
PID 2216 wrote to memory of 3008	2216	852b8d4d2a9c586f32b54da471082b58.exe	28
PID 2216 wrote to memory of 3008	2216	852b8d4d2a9c586f32b54da471082b58.exe	28
PID 2216 wrote to memory of 3008	2216	852b8d4d2a9c586f32b54da471082b58.exe	28

C:\Users\Admin\AppData\Local\Temp\852b8d4d2a9c586f32b54da471082b58.exe
"C:\Users\Admin\AppData\Local\Temp\852b8d4d2a9c586f32b54da471082b58.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 36
  2⤵
  - Program crash
  PID:3008

memory/2216-0-0x0000000000840000-0x000000000087F000-memory.dmp

Download

memory/2216-1-0x0000000000840000-0x000000000087F000-memory.dmp

Download

memory/2216-2-0x0000000000880000-0x0000000000B83000-memory.dmp

Download

memory/2216-3-0x0000000000840000-0x000000000087F000-memory.dmp

Download