f538afb98ab7b60461c3868ecc01e6574d111a24a3324dc34e68a41c13272485

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 05:10

Target

988ebfc7c57c062311dd7a5828d95ef2.exe
Size

360KB
MD5

988ebfc7c57c062311dd7a5828d95ef2
SHA1

060e353c7637c70a239d3683b1f0af0a11a4579c
SHA256

f538afb98ab7b60461c3868ecc01e6574d111a24a3324dc34e68a41c13272485
SHA512

88dc7a8a6c1f460991edbc0aa6d9f96521fce92e77dbf586f8aca7d68e7b1fcbfe690eafbc80bca0f31007fd2fc02f48f91c082c64836224debb3efc69826cbd
SSDEEP

6144:phRj+kspFLNBTJPd9wuKag12XMTRrdQgxjfEN1:phRj+vpFxBTJPjwuKrQgxjfU1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2992	1420	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 2992	1420	988ebfc7c57c062311dd7a5828d95ef2.exe	28
PID 1420 wrote to memory of 2992	1420	988ebfc7c57c062311dd7a5828d95ef2.exe	28
PID 1420 wrote to memory of 2992	1420	988ebfc7c57c062311dd7a5828d95ef2.exe	28
PID 1420 wrote to memory of 2992	1420	988ebfc7c57c062311dd7a5828d95ef2.exe	28

C:\Users\Admin\AppData\Local\Temp\988ebfc7c57c062311dd7a5828d95ef2.exe
"C:\Users\Admin\AppData\Local\Temp\988ebfc7c57c062311dd7a5828d95ef2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 212
  2⤵
  - Program crash
  PID:2992