51cba9b4aefefaf72a791e1929f98553f50d643a22179a6aaac9d13f45ea8b43

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 22:55

Target

51cba9b4aefefaf72a791e1929f98553f50d643a22179a6aaac9d13f45ea8b43.exe
Size

355KB
MD5

22152460b13e4c2473dc3fcdea192933
SHA1

48ce4a69302e860cd905cd02a10aac942f09d9f3
SHA256

51cba9b4aefefaf72a791e1929f98553f50d643a22179a6aaac9d13f45ea8b43
SHA512

1dbcc6f21c9adfc4f28434cffac8c00fb251e3fbf574a69345792837989f74bfc74a67462e7c4f71333a07caf90e0f3e6c51daf0b2640bae3e06af14c8855104
SSDEEP

6144:KnRqyzZ8VqCaMx3CkcY7FGCdGr0gx1POGIAYanWdHBSxz27XrvnksFwemJ:6RqyzZ2IOGCgfPOGI2nWdhSzUbkReG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2628	2060	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2628	2060	51cba9b4aefefaf72a791e1929f98553f50d643a22179a6aaac9d13f45ea8b43.exe	28
PID 2060 wrote to memory of 2628	2060	51cba9b4aefefaf72a791e1929f98553f50d643a22179a6aaac9d13f45ea8b43.exe	28
PID 2060 wrote to memory of 2628	2060	51cba9b4aefefaf72a791e1929f98553f50d643a22179a6aaac9d13f45ea8b43.exe	28
PID 2060 wrote to memory of 2628	2060	51cba9b4aefefaf72a791e1929f98553f50d643a22179a6aaac9d13f45ea8b43.exe	28

C:\Users\Admin\AppData\Local\Temp\51cba9b4aefefaf72a791e1929f98553f50d643a22179a6aaac9d13f45ea8b43.exe
"C:\Users\Admin\AppData\Local\Temp\51cba9b4aefefaf72a791e1929f98553f50d643a22179a6aaac9d13f45ea8b43.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 48
  2⤵
  - Program crash
  PID:2628

memory/2060-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2060-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download