9c51c419e7d0f0ebade31495c74cd4e5bb0f9b8000c9dc30ec7b4972fe97a26e

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 00:29

Target

e05567d8283ab2f8e6abe549c0fa74b9.exe
Size

430KB
MD5

e05567d8283ab2f8e6abe549c0fa74b9
SHA1

22bed3ffdc109f3c9333f5ab0d013e17d6318923
SHA256

9c51c419e7d0f0ebade31495c74cd4e5bb0f9b8000c9dc30ec7b4972fe97a26e
SHA512

10b5a3316db6f9e1cecd0fd3a2000e3af8b07afee6cb45fb889fc43a8d19689827b2741fa6a69e1cb68213aa36ba0bfe541d1eb43aa703b32abb4c3ae03dffb0
SSDEEP

6144:Ulsy4TNbEm1B1zzqaCh9Ju/2x+vw0b8ajNglS2+gUXpP9YC4r:UdwNIm1B1zzqrh9Jf+btwSfgUnBI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2796	2840	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2796	2840	e05567d8283ab2f8e6abe549c0fa74b9.exe	28
PID 2840 wrote to memory of 2796	2840	e05567d8283ab2f8e6abe549c0fa74b9.exe	28
PID 2840 wrote to memory of 2796	2840	e05567d8283ab2f8e6abe549c0fa74b9.exe	28
PID 2840 wrote to memory of 2796	2840	e05567d8283ab2f8e6abe549c0fa74b9.exe	28

C:\Users\Admin\AppData\Local\Temp\e05567d8283ab2f8e6abe549c0fa74b9.exe
"C:\Users\Admin\AppData\Local\Temp\e05567d8283ab2f8e6abe549c0fa74b9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 116
  2⤵
  - Program crash
  PID:2796

memory/2840-0-0x00000000011D0000-0x0000000001240000-memory.dmp

Filesize
448KB

Download