5b16f21239f7ceec5172d0696a05b78cc5f2396dda71754f42e404b00a8335e4

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 23:39

Target

289fbe9ea82fd2a11b765d5141e67bf0N.exe
Size

5KB
MD5

289fbe9ea82fd2a11b765d5141e67bf0
SHA1

f23ea504bc2eb212e1e0e1ca80c88a9a2e5d8bf9
SHA256

5b16f21239f7ceec5172d0696a05b78cc5f2396dda71754f42e404b00a8335e4
SHA512

6212d123463c5dd5aab9b9d911f2b6256f3cefee63d57a948bc8251b507feede75652171ea4750abd0d2489c93ee62d2cde5eabb6cc0fa3ab633eea318e079b7
SSDEEP

48:SqlXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7t/RuqSxp:3WLkFfNnOKYloIQ2pm2pbYSNxE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2064	1692	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2064	1692	289fbe9ea82fd2a11b765d5141e67bf0N.exe	30
PID 1692 wrote to memory of 2064	1692	289fbe9ea82fd2a11b765d5141e67bf0N.exe	30
PID 1692 wrote to memory of 2064	1692	289fbe9ea82fd2a11b765d5141e67bf0N.exe	30
PID 1692 wrote to memory of 2064	1692	289fbe9ea82fd2a11b765d5141e67bf0N.exe	30

C:\Users\Admin\AppData\Local\Temp\289fbe9ea82fd2a11b765d5141e67bf0N.exe
"C:\Users\Admin\AppData\Local\Temp\289fbe9ea82fd2a11b765d5141e67bf0N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 48
  2⤵
  - Program crash
  PID:2064