d4cff5d2cbfede1c9b524d14f99093f1889c47a0db46cba51da39fb705745261

Resubmissions

10/07/2024, 08:23

01/12/2023, 15:16

max time kernel
48s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 08:23

Target
out.exe
Size 84KB
Sample240710-kakfcsxarr
SHA256 e91a87b701d08d5ef2113094caf00143de911ee6d79d2d544ac309353542f040
MD5 6b9b4ccf405257ab07822cd355024ef9
SHA1 a302be4fa9aa055015eb1e0db85af50efa040a85
SHA512 7769a96ce282f6133a1eb68282eebb31db912c7bfc46baa727adf9ab26ca19a79bef0f6b9ebba93d508a980e964599bf7eb908c6552dd0aa931320e1211ce7fd
SSDEEP 768:nOPXIRHHC1KGP0cbWDA753381H6zrichXHYojfB13uxP8/SQ49hTMbsJK:nOPaHH+KGP0cbh3I8hooDj3uxP8Vx
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1272	2696	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 1272	2696	out.exe	30
PID 2696 wrote to memory of 1272	2696	out.exe	30
PID 2696 wrote to memory of 1272	2696	out.exe	30
PID 2696 wrote to memory of 1272	2696	out.exe	30

C:\Users\Admin\AppData\Local\Temp\out.exe
"C:\Users\Admin\AppData\Local\Temp\out.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 36
  2⤵
  - Program crash
  PID:1272