5cb7658f004c63d4eb6dead24dc2279e6be3807d8606b0bb08cf2969d0b954ec

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 17:42

Target
751f5a10ac338cf5a9fa1bbd33ba7289.exe
Size 55KB
Sample240125-wabc8scham
SHA256 5cb7658f004c63d4eb6dead24dc2279e6be3807d8606b0bb08cf2969d0b954ec
MD5 751f5a10ac338cf5a9fa1bbd33ba7289
SHA1 b0251efee4b9b6f219b57b8fe9ff0e10390d250b
SHA512 5631ea015e1f34b77ce591eb15edd0b22bcecb79ba34e6e0ebd821b77250eedf96d1865ed1e67cb71e240548d16912ce0b1040a5092bc66a80a3c928449db864
SSDEEP 384:0RQvCOGy3+z23D9TxU4vIk/qD48+xCK+hJS7gez:0OvCOhpPxSDyC1S7g
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1956	1040	WerFault.exe	27

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 1956	1040	751f5a10ac338cf5a9fa1bbd33ba7289.exe	28
PID 1040 wrote to memory of 1956	1040	751f5a10ac338cf5a9fa1bbd33ba7289.exe	28
PID 1040 wrote to memory of 1956	1040	751f5a10ac338cf5a9fa1bbd33ba7289.exe	28
PID 1040 wrote to memory of 1956	1040	751f5a10ac338cf5a9fa1bbd33ba7289.exe	28
PID 1040 wrote to memory of 1956	1040	751f5a10ac338cf5a9fa1bbd33ba7289.exe	28
PID 1040 wrote to memory of 1956	1040	751f5a10ac338cf5a9fa1bbd33ba7289.exe	28
PID 1040 wrote to memory of 1956	1040	751f5a10ac338cf5a9fa1bbd33ba7289.exe	28

C:\Users\Admin\AppData\Local\Temp\751f5a10ac338cf5a9fa1bbd33ba7289.exe
"C:\Users\Admin\AppData\Local\Temp\751f5a10ac338cf5a9fa1bbd33ba7289.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 324
  2⤵
  - Program crash
  PID:1956

memory/1040-0-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/1040-1-0x0000000000210000-0x0000000000232000-memory.dmp

Download

memory/1040-2-0x0000000000210000-0x0000000000232000-memory.dmp

Download