29c6b473256dbf793c70ef0de9ecb827fe48d84ae5a91e12e604da1b71c707d2

Analysis

max time kernel
11s
max time network
15s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 14:29

Target

0025b3dad73c77ad3ec474e68eeb4560N.exe
Size

5KB
MD5

0025b3dad73c77ad3ec474e68eeb4560
SHA1

abda57c62b00e68ddfe94e45ad4dfbb7fa2a78ff
SHA256

29c6b473256dbf793c70ef0de9ecb827fe48d84ae5a91e12e604da1b71c707d2
SHA512

71750afe0a46a436d4f06dde8459d04b2878bcd12fd9f92ee8675f3fe8e8fd433c4c383e858d8f60524173e42452e86c7e5b3dde6c2406d9c1cd41a1a8f54b37
SSDEEP

48:SOlXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7tQRuqSxp:TWLkFfNnOKYloIQ2pm2pbYS8xE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2540	2344	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2540	2344	0025b3dad73c77ad3ec474e68eeb4560N.exe	30
PID 2344 wrote to memory of 2540	2344	0025b3dad73c77ad3ec474e68eeb4560N.exe	30
PID 2344 wrote to memory of 2540	2344	0025b3dad73c77ad3ec474e68eeb4560N.exe	30
PID 2344 wrote to memory of 2540	2344	0025b3dad73c77ad3ec474e68eeb4560N.exe	30

C:\Users\Admin\AppData\Local\Temp\0025b3dad73c77ad3ec474e68eeb4560N.exe
"C:\Users\Admin\AppData\Local\Temp\0025b3dad73c77ad3ec474e68eeb4560N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 48
  2⤵
  - Program crash
  PID:2540