30d063d567f3c5405fb2333fdf742944c3cffcde5ae3778338d4add78344b53e

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 12:48

Target

67a92c50b22a97bfd021efa18442415c.exe
Size

28KB
MD5

67a92c50b22a97bfd021efa18442415c
SHA1

6d8fd86895b302c8acf26e3f8538fa0fdfc21192
SHA256

30d063d567f3c5405fb2333fdf742944c3cffcde5ae3778338d4add78344b53e
SHA512

88409c70a1a0a668d1f2845db23c41259d6a0141068ff39ee69fb2a3934251136d584d75e5c4ffd0c74da6db9968d4ad34ff3aaeb720e90b6bf0846f3df15db3
SSDEEP

384:imOyMLlKMCHgDxwIyA8l9ZoA7k+w9GmhmssR0IkR46nzoYn8mghRtBsIeo/r5qi9:zUlKUyl9x/3x6nzgvM1wrV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2168	2640	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2168	2640	67a92c50b22a97bfd021efa18442415c.exe	28
PID 2640 wrote to memory of 2168	2640	67a92c50b22a97bfd021efa18442415c.exe	28
PID 2640 wrote to memory of 2168	2640	67a92c50b22a97bfd021efa18442415c.exe	28
PID 2640 wrote to memory of 2168	2640	67a92c50b22a97bfd021efa18442415c.exe	28

C:\Users\Admin\AppData\Local\Temp\67a92c50b22a97bfd021efa18442415c.exe
"C:\Users\Admin\AppData\Local\Temp\67a92c50b22a97bfd021efa18442415c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 36
  2⤵
  - Program crash
  PID:2168

memory/2640-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download