523faa0710c6448d4f316f4e2fa7a9f96879b5d353f393b9571324976192eb56

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 16:03

Target

04ccefdda7c764b19eec43f2484c87f6.exe
Size

422KB
MD5

04ccefdda7c764b19eec43f2484c87f6
SHA1

34fe5bb12df49ba7ac58f508652c9c8d5d429a30
SHA256

523faa0710c6448d4f316f4e2fa7a9f96879b5d353f393b9571324976192eb56
SHA512

d72965b19834c0d683fcc050b0a7fd324afb9c4376a77fd5185f7b0500285630d356ca858ba814dda43e41f738c39b64ab17a37151f5fcb787741c462af59630
SSDEEP

6144:ykB1INZdWaFzaE7mDGg7Y4+MFyBPys80G5sEOi9Ri9na5UVx3:ykBgdW/E7mDGg8xMkBp80GiZa5UVh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2512	1244	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2512	1244	04ccefdda7c764b19eec43f2484c87f6.exe	15
PID 1244 wrote to memory of 2512	1244	04ccefdda7c764b19eec43f2484c87f6.exe	15
PID 1244 wrote to memory of 2512	1244	04ccefdda7c764b19eec43f2484c87f6.exe	15
PID 1244 wrote to memory of 2512	1244	04ccefdda7c764b19eec43f2484c87f6.exe	15

C:\Users\Admin\AppData\Local\Temp\04ccefdda7c764b19eec43f2484c87f6.exe
"C:\Users\Admin\AppData\Local\Temp\04ccefdda7c764b19eec43f2484c87f6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 116
  2⤵
  - Program crash
  PID:2512

memory/1244-0-0x0000000001330000-0x000000000139E000-memory.dmp

Filesize
440KB

Download