3b7784f06835270a568a238aacf0f1755d57e5200f108d5461e8479e201cec67

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15/01/2024, 04:50

Target

5c2ea16a6aeacba7a00c6241754ca7c8.exe
Size

14KB
MD5

5c2ea16a6aeacba7a00c6241754ca7c8
SHA1

7d13b521a469f43fc1edce0af1a973a19090c6c2
SHA256

3b7784f06835270a568a238aacf0f1755d57e5200f108d5461e8479e201cec67
SHA512

9adf73deb2f0a41a23fe535c2ea5779764974d442e082b3c40597497d8fa337c814b8c802a5a07cc0c3492294174495ae7be634921883caaf359dcba0ee3800b
SSDEEP

192:eZsoXgz3wBPtW5bpLetPLyFh3I4zhgo6fWlyxuNcgfKYGhG/5JLwHBap:eZKzoPkC5EYYxwXccgSWRJLOBY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2112	1216	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 2112	1216	5c2ea16a6aeacba7a00c6241754ca7c8.exe	27
PID 1216 wrote to memory of 2112	1216	5c2ea16a6aeacba7a00c6241754ca7c8.exe	27
PID 1216 wrote to memory of 2112	1216	5c2ea16a6aeacba7a00c6241754ca7c8.exe	27
PID 1216 wrote to memory of 2112	1216	5c2ea16a6aeacba7a00c6241754ca7c8.exe	27

C:\Users\Admin\AppData\Local\Temp\5c2ea16a6aeacba7a00c6241754ca7c8.exe
"C:\Users\Admin\AppData\Local\Temp\5c2ea16a6aeacba7a00c6241754ca7c8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 36
  2⤵
  - Program crash
  PID:2112