c5a3dbeea17ddba50482e7844a817171580f977dcea9ad7b655d39a934b93b93

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 12:33

Target
8db3c27c31541a43d1adeae01ca7caf3f0c8d6e3733168917ea04d58d7e4a488.exe
Size 332KB
Sample240510-prnxbsef21
SHA256 8db3c27c31541a43d1adeae01ca7caf3f0c8d6e3733168917ea04d58d7e4a488
MD5 179e52553d0fb86da8b84cdef81b8394
SHA1 728405545c126f7e0ca2beee8b650e1f125192a9
SHA512 4fc9150ce2b1bf507da3e0352c0338d31e47230fb3950dcf18a4ab761f73b76ddc3eb40d4fca6a8e071babcf8d7ec7540ab6dcda1f4c655559d25c566421d96b
SSDEEP 6144:RlZwB/LgLN340nTaDpOU7riHRkyghbiSLOboK16cN/LmEbQbq0h+0Xp:RnhLN340nTP+yg5iSCbv1T1bvD0Xp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2220	2060	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2220	2060	8db3c27c31541a43d1adeae01ca7caf3f0c8d6e3733168917ea04d58d7e4a488.exe	29
PID 2060 wrote to memory of 2220	2060	8db3c27c31541a43d1adeae01ca7caf3f0c8d6e3733168917ea04d58d7e4a488.exe	29
PID 2060 wrote to memory of 2220	2060	8db3c27c31541a43d1adeae01ca7caf3f0c8d6e3733168917ea04d58d7e4a488.exe	29
PID 2060 wrote to memory of 2220	2060	8db3c27c31541a43d1adeae01ca7caf3f0c8d6e3733168917ea04d58d7e4a488.exe	29

C:\Users\Admin\AppData\Local\Temp\8db3c27c31541a43d1adeae01ca7caf3f0c8d6e3733168917ea04d58d7e4a488.exe
"C:\Users\Admin\AppData\Local\Temp\8db3c27c31541a43d1adeae01ca7caf3f0c8d6e3733168917ea04d58d7e4a488.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 52
  2⤵
  - Program crash
  PID:2220

memory/2060-0-0x0000000000030000-0x0000000000031000-memory.dmp

Download

memory/2060-1-0x0000000000030000-0x0000000000031000-memory.dmp

Download