2811cd6775c0938f3f37868a9e25bfede0031d6e1f4ec7ac08ff7ae89245e683

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 15:39

Target

c63ec768e28febffa3f0a322e225f017.exe
Size

20KB
MD5

c63ec768e28febffa3f0a322e225f017
SHA1

3d0af8a3367975273060d1ff3d95dae15fbbdce0
SHA256

2811cd6775c0938f3f37868a9e25bfede0031d6e1f4ec7ac08ff7ae89245e683
SHA512

49c9e5623a706aca39d69c743c7c36dc22581e68879a47529d9818d1e83fcad09ed9a166245ca108c4e86dd1c9cbd8e4f3a06e7c8f50437e6f3202cafb1ca548
SSDEEP

384:XaAMo1Db8ys9yW7BWnf0vygxSij20oLyw0hVbOfRwgnwVKUw1:XaAf1n8ys9yaBiAj2LS0wd49

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2960	1528	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 2960	1528	c63ec768e28febffa3f0a322e225f017.exe	28
PID 1528 wrote to memory of 2960	1528	c63ec768e28febffa3f0a322e225f017.exe	28
PID 1528 wrote to memory of 2960	1528	c63ec768e28febffa3f0a322e225f017.exe	28
PID 1528 wrote to memory of 2960	1528	c63ec768e28febffa3f0a322e225f017.exe	28

C:\Users\Admin\AppData\Local\Temp\c63ec768e28febffa3f0a322e225f017.exe
"C:\Users\Admin\AppData\Local\Temp\c63ec768e28febffa3f0a322e225f017.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 92
  2⤵
  - Program crash
  PID:2960