3cf9ed34e2c09aa38e4b8258e4ddb7a9b5226c382429928a59f4909aa9228c5d

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 00:58 UTC

Target

95d46e5659640c66cf8b474b2c9a287a.exe
Size

382KB
MD5

95d46e5659640c66cf8b474b2c9a287a
SHA1

25c1892c13000caee95eb3c09170b6df96147dde
SHA256

3cf9ed34e2c09aa38e4b8258e4ddb7a9b5226c382429928a59f4909aa9228c5d
SHA512

c7ed7983778c7db97e7e545d0cfd469be6139f08f8919e6f5fea09770fea150d890c9923c97ad6fc143f1a9629927ce6d95a2b10b74bd1ccbd9d7417c6fee931
SSDEEP

6144:WIUsIZhxuoZ5la7tMqRjazPG3cokHE2Ba3ErAdJZ4H5oAHDXi9uB+KeMLK09cUBF:W2UhxuoNa5MqR+z+3cokHEQaaAd34eAl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2988	2976	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2988	2976	95d46e5659640c66cf8b474b2c9a287a.exe	28
PID 2976 wrote to memory of 2988	2976	95d46e5659640c66cf8b474b2c9a287a.exe	28
PID 2976 wrote to memory of 2988	2976	95d46e5659640c66cf8b474b2c9a287a.exe	28
PID 2976 wrote to memory of 2988	2976	95d46e5659640c66cf8b474b2c9a287a.exe	28

C:\Users\Admin\AppData\Local\Temp\95d46e5659640c66cf8b474b2c9a287a.exe
"C:\Users\Admin\AppData\Local\Temp\95d46e5659640c66cf8b474b2c9a287a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 36
  2⤵
  - Program crash
  PID:2988