e711890b1f0469e37ad4297058be0b105f7f93c09e62b0f59be9c4f15e3d117c

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 22:50

Target

41567e251d863a5a3fc569cde845b33f.exe
Size

136KB
MD5

41567e251d863a5a3fc569cde845b33f
SHA1

e41fe83f357a5b20ec885fa2a4d5a80928211185
SHA256

e711890b1f0469e37ad4297058be0b105f7f93c09e62b0f59be9c4f15e3d117c
SHA512

669c9b4ae552d4eded32f02a18543966a9812464ef0d8e3bdee50aa077fce888e5b2ad0debb451fa6030219ab3dc4faac5819824e856947601071662f25aadba
SSDEEP

768:g/dyA3n3h8qnkoaayrE13I2x8REgOt7tV6FgDEJRlhnOycL9VRDiG:kdBKBolY3SgyvhwJBXcL9VJf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2108	2544	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2108	2544	41567e251d863a5a3fc569cde845b33f.exe	28
PID 2544 wrote to memory of 2108	2544	41567e251d863a5a3fc569cde845b33f.exe	28
PID 2544 wrote to memory of 2108	2544	41567e251d863a5a3fc569cde845b33f.exe	28
PID 2544 wrote to memory of 2108	2544	41567e251d863a5a3fc569cde845b33f.exe	28

C:\Users\Admin\AppData\Local\Temp\41567e251d863a5a3fc569cde845b33f.exe
"C:\Users\Admin\AppData\Local\Temp\41567e251d863a5a3fc569cde845b33f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 36
  2⤵
  - Program crash
  PID:2108

memory/2544-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download