bea809c754806cfcc976a8486b48def350ba5a697f1b843e324c3be0f22a6430

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 01:40

Target

66901283c5f9a88a67c679aae0424561.exe
Size

176KB
MD5

66901283c5f9a88a67c679aae0424561
SHA1

ab8fe7aa363e5e1ec977b3869770935bb7c30f28
SHA256

bea809c754806cfcc976a8486b48def350ba5a697f1b843e324c3be0f22a6430
SHA512

cffb7016d0ce446efb8c48b99225951f4956bcb662b25aeed7ede59ce175a844b958fbc70a1104e058f9b59f38c5e40bcea096b3ca0977424f502ec83ddf361b
SSDEEP

3072:f+pN0MPHojolcI/AzUjD57MMXRn3ES4niWlCxstMWestZ2GC2VYUffxTDs5B:m5HokKzUjFMMh3ESpcCj1zs3ffYB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2768	2500	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2768	2500	66901283c5f9a88a67c679aae0424561.exe	28
PID 2500 wrote to memory of 2768	2500	66901283c5f9a88a67c679aae0424561.exe	28
PID 2500 wrote to memory of 2768	2500	66901283c5f9a88a67c679aae0424561.exe	28
PID 2500 wrote to memory of 2768	2500	66901283c5f9a88a67c679aae0424561.exe	28

C:\Users\Admin\AppData\Local\Temp\66901283c5f9a88a67c679aae0424561.exe
"C:\Users\Admin\AppData\Local\Temp\66901283c5f9a88a67c679aae0424561.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 88
  2⤵
  - Program crash
  PID:2768

memory/2500-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download