062774690e4b5613f0b33ac68c21b032cd167af4c8979fc7f5fe7260acb2b6c8

Analysis

max time kernel
122s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 15:59

Target

04a20581c1be02c7427cbf3f744131dd.exe
Size

449KB
MD5

04a20581c1be02c7427cbf3f744131dd
SHA1

75383d033c272528f037fb201b3514b1720a5ca1
SHA256

062774690e4b5613f0b33ac68c21b032cd167af4c8979fc7f5fe7260acb2b6c8
SHA512

b457b83d9d1169418335814074cd7abb421fddbcadac611c5776850c685cfd9de9c192280a479bc9cb2db225514fd33c85e48c1fae0a562b42de34092e83ad23
SSDEEP

6144:VUltX8Weim86UpA4p/AtT7BLXyKdZ8InUTljHZIe+w1WjgyumUFu6MDUz4Y:AOWeim8FRpMBLJdZ8pjfdWgGURMQl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2664	1816	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 2664	1816	04a20581c1be02c7427cbf3f744131dd.exe	28
PID 1816 wrote to memory of 2664	1816	04a20581c1be02c7427cbf3f744131dd.exe	28
PID 1816 wrote to memory of 2664	1816	04a20581c1be02c7427cbf3f744131dd.exe	28
PID 1816 wrote to memory of 2664	1816	04a20581c1be02c7427cbf3f744131dd.exe	28

C:\Users\Admin\AppData\Local\Temp\04a20581c1be02c7427cbf3f744131dd.exe
"C:\Users\Admin\AppData\Local\Temp\04a20581c1be02c7427cbf3f744131dd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 132
  2⤵
  - Program crash
  PID:2664

memory/1816-0-0x0000000000CC0000-0x0000000000D09000-memory.dmp

Filesize
292KB

Download
memory/1816-1-0x0000000000CC0000-0x0000000000D09000-memory.dmp

Filesize
292KB

Download