13e8857c71f223ccba8869c95022f13f6b1dac797ecd13218eb4abb69e375e51

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-03-2024 18:05

Target

d429e1dc3fecd0286d05dde60eacd8fa.exe
Size

57KB
MD5

d429e1dc3fecd0286d05dde60eacd8fa
SHA1

ed27b6da3b15425e8ebd461b93ec86a7237cced8
SHA256

13e8857c71f223ccba8869c95022f13f6b1dac797ecd13218eb4abb69e375e51
SHA512

81a8729dafa36affc671d1c5c80307a22af0659ab78c5fe15578108b199246a4c34fde97bb3ea98a74e02d9e0a7658c822b2e059d40324ec3072586c6e9783c3
SSDEEP

768:Ms6TlrI2gPAOJ15upTFe/4ltuZ2MxgIVjMeQbsXFXkD/PYma4q7XgmkK+Vw5rJae:Ms+UjR1STF3kgSH58X7mvkyDvt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
356	2100	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 356	2100	d429e1dc3fecd0286d05dde60eacd8fa.exe	28
PID 2100 wrote to memory of 356	2100	d429e1dc3fecd0286d05dde60eacd8fa.exe	28
PID 2100 wrote to memory of 356	2100	d429e1dc3fecd0286d05dde60eacd8fa.exe	28
PID 2100 wrote to memory of 356	2100	d429e1dc3fecd0286d05dde60eacd8fa.exe	28

C:\Users\Admin\AppData\Local\Temp\d429e1dc3fecd0286d05dde60eacd8fa.exe
"C:\Users\Admin\AppData\Local\Temp\d429e1dc3fecd0286d05dde60eacd8fa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 92
  2⤵
  - Program crash
  PID:356