a53f3f64b322208e03e2bf634a7689dfe224272fbee8aa0c814b96dbb99af5f8

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 20:45

Target

c994b7017e0a917dc0e1711949a0cb58.exe
Size

21KB
MD5

c994b7017e0a917dc0e1711949a0cb58
SHA1

05c09d768af6849c5cf6c5a125f8fe5a62dda699
SHA256

a53f3f64b322208e03e2bf634a7689dfe224272fbee8aa0c814b96dbb99af5f8
SHA512

792186acd2f42b17a3ee9de4f2e05101360e14346d9bffe1757bb40423a1e5fa87a03f598c72d9ab9fc1f3a273222b322ed7bb2b1734ac83914dbe076c39295c
SSDEEP

384:hqVa5iyPPP5eMz7P/PnVIquUh6kYtWINf4vP/P+G/oYxhBYwdexc5JXcWeDo3nH6:hy0H5J/HtmUh7Y34HWmJYwExc5xcWekH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2940	1664	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2940	1664	c994b7017e0a917dc0e1711949a0cb58.exe	28
PID 1664 wrote to memory of 2940	1664	c994b7017e0a917dc0e1711949a0cb58.exe	28
PID 1664 wrote to memory of 2940	1664	c994b7017e0a917dc0e1711949a0cb58.exe	28
PID 1664 wrote to memory of 2940	1664	c994b7017e0a917dc0e1711949a0cb58.exe	28

C:\Users\Admin\AppData\Local\Temp\c994b7017e0a917dc0e1711949a0cb58.exe
"C:\Users\Admin\AppData\Local\Temp\c994b7017e0a917dc0e1711949a0cb58.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 88
  2⤵
  - Program crash
  PID:2940

memory/1664-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download