5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 06:52

Target
5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675.exe
Size 545KB
Sample240610-hncassde21
SHA256 5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675
MD5 cc57562764c9ba73ef6bf0f056e12e30
SHA1 97147bf2317534d7908e18ad1139d2bf04e54990
SHA512 ddbe6484f9f4d98b0ad09a017733599bc62da20e02549d1751c11d9f460c8c95ec0d1563cc5c034e6a7b15d36ca8a3febe2cf7a7aae7e138d1e5e4feea42019b
SSDEEP 12288:Hn9kenWw3Pl/BVHtRPoJU4fZ8dzLO1lotdBhp4HEO:HCenjzR4UcSdzLWo94Ht
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1076	3000	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 1076	3000	5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675.exe	28
PID 3000 wrote to memory of 1076	3000	5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675.exe	28
PID 3000 wrote to memory of 1076	3000	5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675.exe	28
PID 3000 wrote to memory of 1076	3000	5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675.exe	28

C:\Users\Admin\AppData\Local\Temp\5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675.exe
"C:\Users\Admin\AppData\Local\Temp\5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 84
  2⤵
  - Program crash
  PID:1076

memory/3000-0-0x0000000000020000-0x0000000000021000-memory.dmp

Download

memory/3000-1-0x0000000000020000-0x0000000000021000-memory.dmp

Download