0e52549ef51e0ea391351d034c90efb986d7629f6bb26bba689416b87744ebb4

Analysis

max time kernel
31s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 11:50

Target

d2e5c76e842e638832c86e4d03f88ac0N.exe
Size

472KB
MD5

d2e5c76e842e638832c86e4d03f88ac0
SHA1

25075d22f56b12064e68001935a3f862a28c2e44
SHA256

0e52549ef51e0ea391351d034c90efb986d7629f6bb26bba689416b87744ebb4
SHA512

fc922edc38b497bbd47f4609705b0dbe207b4a40635db6b0d49b6eb3f1023b753d7e67999fb9cce04d65bbc3ee31d9fc827690448eb8d09d7946c494c07290bf
SSDEEP

3072:M2egH8RinudiP52xx67lLdHiHDov2egQ2eg0y489Np/9TeqbYwbSqVLp:l7ckgiPA6RpPu7p7t9dY2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2468	2160	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2468	2160	d2e5c76e842e638832c86e4d03f88ac0N.exe	30
PID 2160 wrote to memory of 2468	2160	d2e5c76e842e638832c86e4d03f88ac0N.exe	30
PID 2160 wrote to memory of 2468	2160	d2e5c76e842e638832c86e4d03f88ac0N.exe	30
PID 2160 wrote to memory of 2468	2160	d2e5c76e842e638832c86e4d03f88ac0N.exe	30

C:\Users\Admin\AppData\Local\Temp\d2e5c76e842e638832c86e4d03f88ac0N.exe
"C:\Users\Admin\AppData\Local\Temp\d2e5c76e842e638832c86e4d03f88ac0N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 36
  2⤵
  - Program crash
  PID:2468

memory/2160-1-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download