3a3bff02278b11992dc852e7100ed1c37443569eea0bd3151942290f0b0df00e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 12:31

Target

c3619451c3e2b6c2287b786d56025f66.exe
Size

90KB
MD5

c3619451c3e2b6c2287b786d56025f66
SHA1

abad3c13011dac0ed134a0be6d91cccc5bd6828a
SHA256

3a3bff02278b11992dc852e7100ed1c37443569eea0bd3151942290f0b0df00e
SHA512

d59631ffead55ba137aee715e90419f74adafc08af771e025847b86984e3211b628b01cfa4110ea94f9313a94637977fb889b2163c8b3a7b6d5b62c2db1cf22e
SSDEEP

1536:JWPE6+N1++x2zPSdljJ5fScmo6WQWZJdg6KiuCUAwZhMqJk:Oy0+x2zCljJ8cn/pW6OCUFjJk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2460	2868	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2460	2868	c3619451c3e2b6c2287b786d56025f66.exe	28
PID 2868 wrote to memory of 2460	2868	c3619451c3e2b6c2287b786d56025f66.exe	28
PID 2868 wrote to memory of 2460	2868	c3619451c3e2b6c2287b786d56025f66.exe	28
PID 2868 wrote to memory of 2460	2868	c3619451c3e2b6c2287b786d56025f66.exe	28

C:\Users\Admin\AppData\Local\Temp\c3619451c3e2b6c2287b786d56025f66.exe
"C:\Users\Admin\AppData\Local\Temp\c3619451c3e2b6c2287b786d56025f66.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 36
  2⤵
  - Program crash
  PID:2460

memory/2868-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2868-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download