395f03f8c446ec2b68ee4648ac1de868288d56b86dee8552c8cf3b3b3cc13f6e

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 05:22

Target

860a53d0a9d026277b4b7336203be9fa.exe
Size

3.4MB
MD5

860a53d0a9d026277b4b7336203be9fa
SHA1

31c548e725264e0cce869632a673bc9100496206
SHA256

395f03f8c446ec2b68ee4648ac1de868288d56b86dee8552c8cf3b3b3cc13f6e
SHA512

f4232aa42d5ed14f0def34cfc0861dcc560d459eb25b00e5f0b939beb35e7531a5cb6d065fe9867aba98d1f0dde155acdc4be6600b6552faa0cdc4b4bc355117
SSDEEP

49152:fo71I5tb0FbtkXPSrqcej6pnslh/kbMMBUz013Xh931fE3slfnmKUPkn4TDpOUj4:G1IP0Fu0g32rL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2312	2336	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2312	2336	860a53d0a9d026277b4b7336203be9fa.exe	28
PID 2336 wrote to memory of 2312	2336	860a53d0a9d026277b4b7336203be9fa.exe	28
PID 2336 wrote to memory of 2312	2336	860a53d0a9d026277b4b7336203be9fa.exe	28
PID 2336 wrote to memory of 2312	2336	860a53d0a9d026277b4b7336203be9fa.exe	28

C:\Users\Admin\AppData\Local\Temp\860a53d0a9d026277b4b7336203be9fa.exe
"C:\Users\Admin\AppData\Local\Temp\860a53d0a9d026277b4b7336203be9fa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 88
  2⤵
  - Program crash
  PID:2312

memory/2336-0-0x0000000000400000-0x00000000007F4000-memory.dmp

Filesize
4.0MB

Download
memory/2336-1-0x0000000000400000-0x00000000007F4000-memory.dmp

Filesize
4.0MB

Download