564ad159a3f8903d5e0f5d17eba5bf6c0a619d7f7675ba1e897dce0677bc43f6

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 15:40

Target

0422b23c126085285231f6c35c190d49.exe
Size

430KB
MD5

0422b23c126085285231f6c35c190d49
SHA1

d4a5ecb30f7d753c6fa7f73f49e9668f48f26863
SHA256

564ad159a3f8903d5e0f5d17eba5bf6c0a619d7f7675ba1e897dce0677bc43f6
SHA512

59dc245183d04025a2f04751fbbcf9914afe553b7f17fcc6ba795a097c62ea436cc50849a4aa9f60ed04171ebdbfc52d6aa4354d049d32b1c8d6d34318b8b04c
SSDEEP

6144:mYbWW2WDmyUUqK5EhEMDMg48Td50WKtNvGRNxw8QUjw:mhWjmyUUqK5j030TyNC8Q5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2916	3048	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2916	3048	0422b23c126085285231f6c35c190d49.exe	28
PID 3048 wrote to memory of 2916	3048	0422b23c126085285231f6c35c190d49.exe	28
PID 3048 wrote to memory of 2916	3048	0422b23c126085285231f6c35c190d49.exe	28
PID 3048 wrote to memory of 2916	3048	0422b23c126085285231f6c35c190d49.exe	28

C:\Users\Admin\AppData\Local\Temp\0422b23c126085285231f6c35c190d49.exe
"C:\Users\Admin\AppData\Local\Temp\0422b23c126085285231f6c35c190d49.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 116
  2⤵
  - Program crash
  PID:2916

memory/3048-0-0x00000000011C0000-0x0000000001230000-memory.dmp

Filesize
448KB

Download