42d165d91eb4e6994afb93300dec7e725a66b1594e5ff574e9f2584d287a210b

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-03-2024 13:50

Target

$0/scanquery.exe
Size

25KB
MD5

a5c0bec5e1be55dba3e62e36fce87b37
SHA1

0910490f51cedc197116b0ecaccffc7d320ec555
SHA256

437e4d2f448bc2045069ace7c995f6b6e98677b350d925a7bede7eb1a49d0e45
SHA512

08680a110d1257c16be099f041559bda26d610864dc0406d42436c0f6510f94153410268437787939c5daa05f819ba0ce0edbd3dd0d33bb20e046d7ee7583c30
SSDEEP

384:Z62ygqjvFexVjs2YiB1Xz3a94R8boMb60fQcnvRjdmAl0jN6/Wvilk:ygqj9eTYI1Xza9DcMjfQcnvRBzoBalk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2072	2068	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2072	2068	scanquery.exe	28
PID 2068 wrote to memory of 2072	2068	scanquery.exe	28
PID 2068 wrote to memory of 2072	2068	scanquery.exe	28
PID 2068 wrote to memory of 2072	2068	scanquery.exe	28

C:\Users\Admin\AppData\Local\Temp\$0\scanquery.exe
"C:\Users\Admin\AppData\Local\Temp\$0\scanquery.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 48
  2⤵
  - Program crash
  PID:2072