304e5caab1b6af77e55b0725138af34248cee853a8ada35b75a7fda13b739323

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 06:11

Target

64acff3a6bae8a5fe4eee0ac50a0026f.exe
Size

753KB
MD5

64acff3a6bae8a5fe4eee0ac50a0026f
SHA1

66c26530ff5be9c57c03c446ac771bce5e885c22
SHA256

304e5caab1b6af77e55b0725138af34248cee853a8ada35b75a7fda13b739323
SHA512

9a96110b30e9277a30835d26a3cdf22d8d15307d5157ed97acfecbb2aa4389cb7516f89e4d1f53526e5a5d01a7ce38aaeec8ff12940302eecf9b7c0f4a95bc0e
SSDEEP

12288:axxq+kmSoI88kT7SZZg3RV4NRb+SAchblbQQIuGu+Xu8OwmecyJBB+shUykzr:atkmU88iW7ARajb+oXwu+XrmP1sSyA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2152	3016	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2152	3016	64acff3a6bae8a5fe4eee0ac50a0026f.exe	28
PID 3016 wrote to memory of 2152	3016	64acff3a6bae8a5fe4eee0ac50a0026f.exe	28
PID 3016 wrote to memory of 2152	3016	64acff3a6bae8a5fe4eee0ac50a0026f.exe	28
PID 3016 wrote to memory of 2152	3016	64acff3a6bae8a5fe4eee0ac50a0026f.exe	28

C:\Users\Admin\AppData\Local\Temp\64acff3a6bae8a5fe4eee0ac50a0026f.exe
"C:\Users\Admin\AppData\Local\Temp\64acff3a6bae8a5fe4eee0ac50a0026f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 44
  2⤵
  - Program crash
  PID:2152

memory/3016-0-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download
memory/3016-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/3016-2-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/3016-3-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download