cc83552cbd305ac120920f18e2e4743b0dcaef8947704f15f262a6cc6e69ec40

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 16:16

Target

d68fb780409914a42e3f46e80a7fde56.exe
Size

125KB
MD5

d68fb780409914a42e3f46e80a7fde56
SHA1

db2ee2eb978cb421f5d1a8ab94194db1f788d506
SHA256

cc83552cbd305ac120920f18e2e4743b0dcaef8947704f15f262a6cc6e69ec40
SHA512

5a0a761f4b2c8b39928875d02c20677df4835f06116afeadc90c31a005f5af0fce7f1388079e03cf00ffa86058007ee712b4be2a7cf8eee447da671988614825
SSDEEP

3072:vC3tUabUnliyrn2Ysq/lsiU7NwxJKJA4Utsygoid:vCGaElbZsq/5UBwxJKJALsNoQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2652	2512	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2652	2512	d68fb780409914a42e3f46e80a7fde56.exe	28
PID 2512 wrote to memory of 2652	2512	d68fb780409914a42e3f46e80a7fde56.exe	28
PID 2512 wrote to memory of 2652	2512	d68fb780409914a42e3f46e80a7fde56.exe	28
PID 2512 wrote to memory of 2652	2512	d68fb780409914a42e3f46e80a7fde56.exe	28

C:\Users\Admin\AppData\Local\Temp\d68fb780409914a42e3f46e80a7fde56.exe
"C:\Users\Admin\AppData\Local\Temp\d68fb780409914a42e3f46e80a7fde56.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 36
  2⤵
  - Program crash
  PID:2652

memory/2512-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2512-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download