e4c88d9d94e1065d39bdb17408b2cd61d0be738b88670e643ed1e3e78b8fa166

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 23:27

Target

433488eb8a5833449ae96081304ea950.exe
Size

76KB
MD5

433488eb8a5833449ae96081304ea950
SHA1

baf2b3bd2509411cacd82e4d41a3fdef84bfc24f
SHA256

e4c88d9d94e1065d39bdb17408b2cd61d0be738b88670e643ed1e3e78b8fa166
SHA512

425934f2ef6ad838d18cffc3636492ec192fff36e147471a4213925b8b3dcad8c313d81d023a025820c899595691e1888bc3e86583cfab0b04bda57bf4da24a8
SSDEEP

1536:a/ePyXHZ7DA4BfBrmTiXvvvUgbFNCuACP1DIgN:geSHZ7DTBfBrB/UgbFNCuAq2C

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2916	2908	WerFault.exe	7

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2916	2908	433488eb8a5833449ae96081304ea950.exe	16
PID 2908 wrote to memory of 2916	2908	433488eb8a5833449ae96081304ea950.exe	16
PID 2908 wrote to memory of 2916	2908	433488eb8a5833449ae96081304ea950.exe	16
PID 2908 wrote to memory of 2916	2908	433488eb8a5833449ae96081304ea950.exe	16

C:\Users\Admin\AppData\Local\Temp\433488eb8a5833449ae96081304ea950.exe
"C:\Users\Admin\AppData\Local\Temp\433488eb8a5833449ae96081304ea950.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 108
  2⤵
  - Program crash
  PID:2916

memory/2908-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2908-1-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download