5db99368bb08775c78e6b1e4b7d783b6e9dd6928a20ac1357972381c30d7032e

Analysis

max time kernel
156s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 22:26

Target

7e2a531c63990c925f139c19481a8b9e.exe
Size

89KB
MD5

7e2a531c63990c925f139c19481a8b9e
SHA1

3072ec9caca1f6f404ac525834c1bfe3018fd5b2
SHA256

5db99368bb08775c78e6b1e4b7d783b6e9dd6928a20ac1357972381c30d7032e
SHA512

64e4835bd69f46ee3b286dbf2327ea83ad15a308077164927cc5c3495872f3e7e2f1ac380ffd962b2ed60067b2589f04962ef43c284f72e87bad1107a06cfd81
SSDEEP

768:eLn2mXHRwnlkKPJU/V4Uk1AW4sfILv0rHyIJ/vP59+CwbCVMB4WkbTY:ENmpP+/ZKzfrHNPT+CwbCFT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4972	4500	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 4972	4500	7e2a531c63990c925f139c19481a8b9e.exe	88
PID 4500 wrote to memory of 4972	4500	7e2a531c63990c925f139c19481a8b9e.exe	88
PID 4500 wrote to memory of 4972	4500	7e2a531c63990c925f139c19481a8b9e.exe	88

C:\Users\Admin\AppData\Local\Temp\7e2a531c63990c925f139c19481a8b9e.exe
"C:\Users\Admin\AppData\Local\Temp\7e2a531c63990c925f139c19481a8b9e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 384
  2⤵
  - Program crash
  PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4500 -ip 4500
1⤵
PID:2108

memory/4500-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4500-1-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download