e714318a06192f327081acc821250de6018487f7299c06e36412f68841991ae0

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 16:03

Target

04c602c71b989053f19d9cc1a7f00449.exe
Size

524KB
MD5

04c602c71b989053f19d9cc1a7f00449
SHA1

e9a48124bff77627ce1fc33796b7cb70b78740a1
SHA256

e714318a06192f327081acc821250de6018487f7299c06e36412f68841991ae0
SHA512

7f3a5cec589056b245e100ce7fe20f8f17030db61cd47ff729a9e22fcc1738204f384ab0031ea42220f43714e043b8c41607fe860701266731ee4a209d83b607
SSDEEP

6144:RgakN0xC+Le9IcEXPVqPI5uImhbo4YIEgMoFEUH4hF8KPkw:RrxC+a9jEXPycuHxE3xnPX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2276	1452	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 2276	1452	04c602c71b989053f19d9cc1a7f00449.exe	28
PID 1452 wrote to memory of 2276	1452	04c602c71b989053f19d9cc1a7f00449.exe	28
PID 1452 wrote to memory of 2276	1452	04c602c71b989053f19d9cc1a7f00449.exe	28
PID 1452 wrote to memory of 2276	1452	04c602c71b989053f19d9cc1a7f00449.exe	28

C:\Users\Admin\AppData\Local\Temp\04c602c71b989053f19d9cc1a7f00449.exe
"C:\Users\Admin\AppData\Local\Temp\04c602c71b989053f19d9cc1a7f00449.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 188
  2⤵
  - Program crash
  PID:2276

memory/1452-0-0x0000000000800000-0x000000000085E000-memory.dmp

Filesize
376KB

Download
memory/1452-1-0x0000000000800000-0x000000000085E000-memory.dmp

Filesize
376KB

Download