1532d639d7115c58c2b1e2b427fc83748888e09f5f95ed79be07f6201f27e353

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/02/2024, 16:32

Target

1532d639d7115c58c2b1e2b427fc83748888e09f5f95ed79be07f6201f27e353.exe
Size

5KB
MD5

395a7ee8579df03945ea891eb4594360
SHA1

c2e9902fe797f4d21a830f8d9b7c43be5d538af0
SHA256

1532d639d7115c58c2b1e2b427fc83748888e09f5f95ed79be07f6201f27e353
SHA512

1bcea83919fdc0caaa900ddcd5d3b302b087c6e8fc368a95eabbc42b70a572b3b556bed630fb4869e0159909850aa4225f410986603c7ab2e6b3b840691f20b6
SSDEEP

48:SO3lXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7t7RuqSxp:FBWLkFfNnOKYloIQ2pm2pbYSJxE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3048	2948	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 3048	2948	1532d639d7115c58c2b1e2b427fc83748888e09f5f95ed79be07f6201f27e353.exe	28
PID 2948 wrote to memory of 3048	2948	1532d639d7115c58c2b1e2b427fc83748888e09f5f95ed79be07f6201f27e353.exe	28
PID 2948 wrote to memory of 3048	2948	1532d639d7115c58c2b1e2b427fc83748888e09f5f95ed79be07f6201f27e353.exe	28
PID 2948 wrote to memory of 3048	2948	1532d639d7115c58c2b1e2b427fc83748888e09f5f95ed79be07f6201f27e353.exe	28

C:\Users\Admin\AppData\Local\Temp\1532d639d7115c58c2b1e2b427fc83748888e09f5f95ed79be07f6201f27e353.exe
"C:\Users\Admin\AppData\Local\Temp\1532d639d7115c58c2b1e2b427fc83748888e09f5f95ed79be07f6201f27e353.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 48
  2⤵
  - Program crash
  PID:3048