4014fa4edf1128c026f021393ff98c5004ae066d6a407fa52d99aecf7a07d43c

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 22:03

Target

3ed6b76d2d386587602d7444654242fc.exe
Size

1.1MB
MD5

3ed6b76d2d386587602d7444654242fc
SHA1

2db8fa254969f72098a33d58af5ea62c0402744e
SHA256

4014fa4edf1128c026f021393ff98c5004ae066d6a407fa52d99aecf7a07d43c
SHA512

8d1e0037b1eaf0d48128e75fc3908088e5d66897615e8f2dbb80ae30191fe813865f2998dc15b5fd7b8511dfddb2bd3513bac6650f2bf5518c943e8bfb901287
SSDEEP

24576:nv8UD0GHKVttOY2cchPHr5A/quXn8pFZwUTPt52zubp5iwE+8N87X:n0UD0UKVtth2cchPHr5A/3nAFZ94zub1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2560	2756	WerFault.exe	6

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2560	2756	3ed6b76d2d386587602d7444654242fc.exe	29
PID 2756 wrote to memory of 2560	2756	3ed6b76d2d386587602d7444654242fc.exe	29
PID 2756 wrote to memory of 2560	2756	3ed6b76d2d386587602d7444654242fc.exe	29
PID 2756 wrote to memory of 2560	2756	3ed6b76d2d386587602d7444654242fc.exe	29

C:\Users\Admin\AppData\Local\Temp\3ed6b76d2d386587602d7444654242fc.exe
"C:\Users\Admin\AppData\Local\Temp\3ed6b76d2d386587602d7444654242fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 216
  2⤵
  - Program crash
  PID:2560

memory/2756-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2756-1-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/2756-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2756-6-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download