d50dd36053ff4df36409ce61366228bebd53bf9202cbfca6a5f856019858d8ed

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 16:53

Target

658accbf8ec847b7986696a85c88e29b.exe
Size

354KB
MD5

658accbf8ec847b7986696a85c88e29b
SHA1

0d90f65aeacaeba8c2e9d20abc3fbf63601be7b0
SHA256

d50dd36053ff4df36409ce61366228bebd53bf9202cbfca6a5f856019858d8ed
SHA512

e5d6557e6c9f5bfe48d6321117da2d76bd90cfd9f5094962075b322f84f697d23a5164b02bd8f25e85aa93d1ab419386dc0642625027334f46052b45f1c726c3
SSDEEP

6144:3j6pF7wEWKn8TJdjIdi59Uu1lSY6mIePb5jC9XTBQi584xO:2bwEW48TJuKqu1H6mIez5jC9XTxLO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2956	2172	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2956	2172	658accbf8ec847b7986696a85c88e29b.exe	28
PID 2172 wrote to memory of 2956	2172	658accbf8ec847b7986696a85c88e29b.exe	28
PID 2172 wrote to memory of 2956	2172	658accbf8ec847b7986696a85c88e29b.exe	28
PID 2172 wrote to memory of 2956	2172	658accbf8ec847b7986696a85c88e29b.exe	28

C:\Users\Admin\AppData\Local\Temp\658accbf8ec847b7986696a85c88e29b.exe
"C:\Users\Admin\AppData\Local\Temp\658accbf8ec847b7986696a85c88e29b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 204
  2⤵
  - Program crash
  PID:2956

memory/2172-0-0x0000000000400000-0x000000000046101B-memory.dmp

Filesize
388KB

Download
memory/2172-1-0x0000000000400000-0x000000000046101B-memory.dmp

Filesize
388KB

Download