e36c5bd2fb4536059fbdd783957ff54101aebd21e553249535afd852e635814f

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 02:33

Target
e36c5bd2fb4536059fbdd783957ff54101aebd21e553249535afd852e635814f.exe
Size 2.3MB
Sample240525-c19h6sbe5w
SHA256 e36c5bd2fb4536059fbdd783957ff54101aebd21e553249535afd852e635814f
MD5 dc1b910a198fcf10b45f278d0d3b6372
SHA1 ceb2c2fbff59bf6216bf742d936517ef3b457704
SHA512 205c2389a99b2e17d14ecbe5e5faebaf20b3663163df20fff709e45908f4877d2f06c601e0b205f1c953ec2521fe6871c079e1e674d308decb2527a7350a94b3
SSDEEP 49152:Avz0YnhEJ6V8WCl0s3pAns0F/pPQjg/2D2YG02EzL9:Qz0YnhEJ6V8U6ejxpEU2qYGhEh
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2508	2512	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2508	2512	e36c5bd2fb4536059fbdd783957ff54101aebd21e553249535afd852e635814f.exe	28
PID 2512 wrote to memory of 2508	2512	e36c5bd2fb4536059fbdd783957ff54101aebd21e553249535afd852e635814f.exe	28
PID 2512 wrote to memory of 2508	2512	e36c5bd2fb4536059fbdd783957ff54101aebd21e553249535afd852e635814f.exe	28
PID 2512 wrote to memory of 2508	2512	e36c5bd2fb4536059fbdd783957ff54101aebd21e553249535afd852e635814f.exe	28

C:\Users\Admin\AppData\Local\Temp\e36c5bd2fb4536059fbdd783957ff54101aebd21e553249535afd852e635814f.exe
"C:\Users\Admin\AppData\Local\Temp\e36c5bd2fb4536059fbdd783957ff54101aebd21e553249535afd852e635814f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 224
  2⤵
  - Program crash
  PID:2508