e51d64576c9ccf7f3bae0a50a8bdf40a8b198c68faa782b8bc8b7b4cf76c557d

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 03:36

Target

73a1a95c42228b7e212d0b73562f1f77.exe
Size

48KB
MD5

73a1a95c42228b7e212d0b73562f1f77
SHA1

ed13d653e9f4f71c14ba1162179242a69da82ddd
SHA256

e51d64576c9ccf7f3bae0a50a8bdf40a8b198c68faa782b8bc8b7b4cf76c557d
SHA512

e543dad26b58232f793e5468942dae1b8ab342c7d2f670f6a03f4e80f3dbe0bc22a1a5cf7f30abb5bbd2631700535bc04745fc7deee1e679c7142c28442b476c
SSDEEP

768:yiumHOP81r3dRSj/6Oq6+/fJHuEs87/nmPSJzRI3w/FvEiNl+x4H:yiumHq81r3/WiOq6+/fBsW/rJNIavV+u

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2912	2968	WerFault.exe	3

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2912	2968	73a1a95c42228b7e212d0b73562f1f77.exe	28
PID 2968 wrote to memory of 2912	2968	73a1a95c42228b7e212d0b73562f1f77.exe	28
PID 2968 wrote to memory of 2912	2968	73a1a95c42228b7e212d0b73562f1f77.exe	28
PID 2968 wrote to memory of 2912	2968	73a1a95c42228b7e212d0b73562f1f77.exe	28

C:\Users\Admin\AppData\Local\Temp\73a1a95c42228b7e212d0b73562f1f77.exe
"C:\Users\Admin\AppData\Local\Temp\73a1a95c42228b7e212d0b73562f1f77.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 124
  2⤵
  - Program crash
  PID:2912