01753fa850cfe887e90e68f681c33a506a0a26b964b3d44b02837474262f8b59

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 16:43

Target

68204b3303ba0fded5549aa22daf35c3.exe
Size

31KB
MD5

68204b3303ba0fded5549aa22daf35c3
SHA1

698f97bc864854b26d409438476e0ebe11c4b328
SHA256

01753fa850cfe887e90e68f681c33a506a0a26b964b3d44b02837474262f8b59
SHA512

3a16ad34adc9a9507bc7ba1e87cfb52d15200b61782a4b6547b1a135bf58d61db9641b37bc2498136f90bdd6606d444f1953f40903608dbb95bbe07ec4544e2c
SSDEEP

384:ZuB8nthlKnn3JXAAis4ZHAAMTRVDn0b6be/WLp6PU4:q8ntvKqAit+AGRVDna6be+Lp6PU4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2460	2432	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2460	2432	68204b3303ba0fded5549aa22daf35c3.exe	28
PID 2432 wrote to memory of 2460	2432	68204b3303ba0fded5549aa22daf35c3.exe	28
PID 2432 wrote to memory of 2460	2432	68204b3303ba0fded5549aa22daf35c3.exe	28
PID 2432 wrote to memory of 2460	2432	68204b3303ba0fded5549aa22daf35c3.exe	28

C:\Users\Admin\AppData\Local\Temp\68204b3303ba0fded5549aa22daf35c3.exe
"C:\Users\Admin\AppData\Local\Temp\68204b3303ba0fded5549aa22daf35c3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 148
  2⤵
  - Program crash
  PID:2460

memory/2432-0-0x0000000000400000-0x0000000000405730-memory.dmp

Filesize
21KB

Download