d1dc93342bc9b0e8ee7f2850bce8eeac7a5229610bc295e22575dfa62c4979be

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
15-07-2023 13:40

Target

4dc592458df2edexeexe_JC.exe
Size

335KB
MD5

4dc592458df2ed74e7a2182b55e3e65b
SHA1

36b9cd30e0460d89188789f1b2249f3c0f1bba73
SHA256

d1dc93342bc9b0e8ee7f2850bce8eeac7a5229610bc295e22575dfa62c4979be
SHA512

e47926f86df2e8ecafc0d818fa6322abb0ba972b2b961015f8b2c84b6fcc45e4d544d82038bc3795f38255bb1ccbd6b0a788d849fe198fe2cf90795e038b633f
SSDEEP

6144:qtUGfUWOeEBUEhLkXj3zRG6yLQ/UNP4H2CiTTp10qhh4IAjrt:qtUGfVwUFzRG6EQ0POfiTTf0qdAjrt

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3040 2892 WerFault.exe 4dc592458df2edexeexe_JC.exe

pid	pid_target	process	target process
3040	2892	WerFault.exe	4dc592458df2edexeexe_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4dc592458df2edexeexe_JC.exe

description	pid	process	target process
PID 2892 wrote to memory of 3040	2892	4dc592458df2edexeexe_JC.exe	WerFault.exe
PID 2892 wrote to memory of 3040	2892	4dc592458df2edexeexe_JC.exe	WerFault.exe
PID 2892 wrote to memory of 3040	2892	4dc592458df2edexeexe_JC.exe	WerFault.exe
PID 2892 wrote to memory of 3040	2892	4dc592458df2edexeexe_JC.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4dc592458df2edexeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\4dc592458df2edexeexe_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 120
2⤵
- Program crash
PID:3040