13279f024d4379824c9fc6dd56706565903fa6cb03021cb7f634946406fbd1ec

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 12:31

Target

97285485a723787f8e4b066170de9706.exe
Size

196KB
MD5

97285485a723787f8e4b066170de9706
SHA1

bd43f2dfae33d958b8af18cd3fc107499e31bbcf
SHA256

13279f024d4379824c9fc6dd56706565903fa6cb03021cb7f634946406fbd1ec
SHA512

741536010e796eaade49147a130f79b24640582f0a2da0bb491a2b6f4a6cc83f498369904306b0acd222339f4100eea71f31ee3d909244eabc4ef4b31326ca02
SSDEEP

1536:xOZrZk50S1VMG4W0O+CcQL16iYlaNsDaFiwhiJ8D0vVMndOZoz6g5bdVRpabv/Cn:6qVMTW0hiJWki77ZCJdlwv/C/iM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2240	1900	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2240	1900	97285485a723787f8e4b066170de9706.exe	28
PID 1900 wrote to memory of 2240	1900	97285485a723787f8e4b066170de9706.exe	28
PID 1900 wrote to memory of 2240	1900	97285485a723787f8e4b066170de9706.exe	28
PID 1900 wrote to memory of 2240	1900	97285485a723787f8e4b066170de9706.exe	28

C:\Users\Admin\AppData\Local\Temp\97285485a723787f8e4b066170de9706.exe
"C:\Users\Admin\AppData\Local\Temp\97285485a723787f8e4b066170de9706.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 36
  2⤵
  - Program crash
  PID:2240