843d237f0cd791655b7e99607a0af9af71aefd12e9f2240e6abe21689918e4c1

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 07:25

Target

$0/questscan.exe
Size

36KB
MD5

fd4bf3c03896afecad0398c8b553e788
SHA1

40d91a9473544ff9a9c7502434be82cb54e793d1
SHA256

d51295965f579890b03219f439ced186c6ad25fd6b8ab08c2dd622b2b298c466
SHA512

a2f9217de88beae3634d6eff88ffccd97b4598d76b3a414c63275d1f4af210e8836f17ab770178c8757e29c51e0190eaf94a4493a4b0cf29f34d0457b35af49e
SSDEEP

384:IGEghrtOa5kreK37dXR5HDFDJz9nIABRebGSUp5c44VjiGESIRjlTHjN6/WvilE:LEghOdXRD99nFyCLpa44VjrEBXtBal

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2156	2100	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2156	2100	questscan.exe	28
PID 2100 wrote to memory of 2156	2100	questscan.exe	28
PID 2100 wrote to memory of 2156	2100	questscan.exe	28
PID 2100 wrote to memory of 2156	2100	questscan.exe	28

C:\Users\Admin\AppData\Local\Temp\$0\questscan.exe
"C:\Users\Admin\AppData\Local\Temp\$0\questscan.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 48
  2⤵
  - Program crash
  PID:2156