e5ff3c02fda74617430fb1d60d5126cf1e517311c4b68e7181dcea0b58a4005f

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 05:45

Target

1713159844f1475a5b902e14dda4388c0ce3aba7deba1df99aa8adf460463c1d317fea8f7b195.dat-decoded.exe
Size

264KB
MD5

56e6e0768aee417abb6c2b0e795955c9
SHA1

b7ffc883ac73b183c5fe26f874b65e82a13ac247
SHA256

e5ff3c02fda74617430fb1d60d5126cf1e517311c4b68e7181dcea0b58a4005f
SHA512

446385bd25f980bba24f4ca178d6b6a6fe538dedeebcf561b9140c8ec064a77c4d6f2690f7ac47f42a041c260d91f8c64cc14a506cfa899c81fba980760d5c3e
SSDEEP

6144:cQguJjLqcJX8ZMZTLmMxpJKO3TNBZaHLjEZ16BBoyNJ+/oJnxBol1G:iuJPqcJMZCxxpU+BZaH3u16BBoyP7Jxe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2996	2192	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2192	1713159844f1475a5b902e14dda4388c0ce3aba7deba1df99aa8adf460463c1d317fea8f7b195.dat-decoded.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2996	2192	1713159844f1475a5b902e14dda4388c0ce3aba7deba1df99aa8adf460463c1d317fea8f7b195.dat-decoded.exe	28
PID 2192 wrote to memory of 2996	2192	1713159844f1475a5b902e14dda4388c0ce3aba7deba1df99aa8adf460463c1d317fea8f7b195.dat-decoded.exe	28
PID 2192 wrote to memory of 2996	2192	1713159844f1475a5b902e14dda4388c0ce3aba7deba1df99aa8adf460463c1d317fea8f7b195.dat-decoded.exe	28
PID 2192 wrote to memory of 2996	2192	1713159844f1475a5b902e14dda4388c0ce3aba7deba1df99aa8adf460463c1d317fea8f7b195.dat-decoded.exe	28

C:\Users\Admin\AppData\Local\Temp\1713159844f1475a5b902e14dda4388c0ce3aba7deba1df99aa8adf460463c1d317fea8f7b195.dat-decoded.exe
"C:\Users\Admin\AppData\Local\Temp\1713159844f1475a5b902e14dda4388c0ce3aba7deba1df99aa8adf460463c1d317fea8f7b195.dat-decoded.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 36
  2⤵
  - Program crash
  PID:2996

memory/2192-0-0x0000000000260000-0x00000000002A2000-memory.dmp

Filesize
264KB

Download
memory/2192-1-0x0000000000260000-0x00000000002A2000-memory.dmp

Filesize
264KB

Download
memory/2192-2-0x0000000000A70000-0x0000000000D73000-memory.dmp

Filesize
3.0MB

Download
memory/2192-3-0x0000000000260000-0x00000000002A2000-memory.dmp

Filesize
264KB

Download