f540f6c95fa0bdeffd7c1cb78e7f21e61e872fdc5370a66463e17be9fb8fe8c1

Analysis

max time kernel
142s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15/10/2023, 19:50

Target

f49660ac5124b41ee919f12e80b566b0_exe32.exe
Size

220KB
MD5

f49660ac5124b41ee919f12e80b566b0
SHA1

26112af78abde079a9f24afd69099b6f7f943726
SHA256

f540f6c95fa0bdeffd7c1cb78e7f21e61e872fdc5370a66463e17be9fb8fe8c1
SHA512

5c41edf2e00a4c5bc687ce4e1853d0fdff75f1ec069d3559e5ed9c74bcde03cdc722c35768a63f3bae2a797854a014d8f2299b9d78b92f3878af3cfd312a712e
SSDEEP

3072:1VJ2y5SWCBBBBBBBBBBBBBBa1NHdTwr6G0vEkuHybG00FCwDMWq0mHr/XTwr6G0p:1b2A5dThpvFbG00JoWcHr/XThpvFb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2548	3020	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2548	3020	f49660ac5124b41ee919f12e80b566b0_exe32.exe	28
PID 3020 wrote to memory of 2548	3020	f49660ac5124b41ee919f12e80b566b0_exe32.exe	28
PID 3020 wrote to memory of 2548	3020	f49660ac5124b41ee919f12e80b566b0_exe32.exe	28
PID 3020 wrote to memory of 2548	3020	f49660ac5124b41ee919f12e80b566b0_exe32.exe	28

C:\Users\Admin\AppData\Local\Temp\f49660ac5124b41ee919f12e80b566b0_exe32.exe
"C:\Users\Admin\AppData\Local\Temp\f49660ac5124b41ee919f12e80b566b0_exe32.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 140
  2⤵
  - Program crash
  PID:2548

memory/3020-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3020-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download