5ae51e30817c0d08d03f120539aedc31d094b080eb70c0691bbfbaa4ec265ef3

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27-01-2024 14:07

Target

7a731229659ec9175cfaf1358d0367f2.exe
Size

2.2MB
MD5

7a731229659ec9175cfaf1358d0367f2
SHA1

2877b32518445c09418849eb8fb913ed73d7b8fb
SHA256

5ae51e30817c0d08d03f120539aedc31d094b080eb70c0691bbfbaa4ec265ef3
SHA512

c02df22e900fc9740726e87e991345fd096dd8696c2e3d1365fc40f83c9303fb05b88c1919aa3196377beb076b1f6f5381c4f915b4c368bbc5d5a98047ae57d0
SSDEEP

24576:xZKdl5quka1RVs/D8YUT8qg+kFpV/XoZZeUK8rYy6YNKcgdYuD6zoMyRD0N43yw/:xZ68s/LgkrK8cTCqrc0krCAUvJFU1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2984	2060	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2984	2060	7a731229659ec9175cfaf1358d0367f2.exe	29
PID 2060 wrote to memory of 2984	2060	7a731229659ec9175cfaf1358d0367f2.exe	29
PID 2060 wrote to memory of 2984	2060	7a731229659ec9175cfaf1358d0367f2.exe	29
PID 2060 wrote to memory of 2984	2060	7a731229659ec9175cfaf1358d0367f2.exe	29

C:\Users\Admin\AppData\Local\Temp\7a731229659ec9175cfaf1358d0367f2.exe
"C:\Users\Admin\AppData\Local\Temp\7a731229659ec9175cfaf1358d0367f2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 48
  2⤵
  - Program crash
  PID:2984