8325356d31d95fc5e8f75919b05fa625ec902ddc71a2877f457c87ab69056d25

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 12:35

Target

c363357144dd12b231936dc54847c75f.exe
Size

44KB
MD5

c363357144dd12b231936dc54847c75f
SHA1

a80d69989a6ce4327bb4dd30f0901ea9443698cb
SHA256

8325356d31d95fc5e8f75919b05fa625ec902ddc71a2877f457c87ab69056d25
SHA512

afc12e0c19e1ce4cf1059c2aadd237593715fa1f6c8218b08408613682b505e07bba41fba979c998e26ba03f290595318df86dc897c5779853dce67b8ccae3bd
SSDEEP

768:FiU+Xt42WXRIlls84EU233dbSlbIY+zIXX+TjbC7p4BLfUtiKpA:FiU+XtTWXR6s84O3gbI7jbm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2172	1964	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2172	1964	c363357144dd12b231936dc54847c75f.exe	28
PID 1964 wrote to memory of 2172	1964	c363357144dd12b231936dc54847c75f.exe	28
PID 1964 wrote to memory of 2172	1964	c363357144dd12b231936dc54847c75f.exe	28
PID 1964 wrote to memory of 2172	1964	c363357144dd12b231936dc54847c75f.exe	28

C:\Users\Admin\AppData\Local\Temp\c363357144dd12b231936dc54847c75f.exe
"C:\Users\Admin\AppData\Local\Temp\c363357144dd12b231936dc54847c75f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 160
  2⤵
  - Program crash
  PID:2172

memory/1964-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1964-1-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download