3c6cf3af24c64d948f7ab638a97071c4e939f42762af12768eee3e4e22479e40

Analysis

max time kernel
61s
max time network
31s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 23:34

Target

4389fadbb20f25516f6f7de2ff03fa6f.exe
Size

368KB
MD5

4389fadbb20f25516f6f7de2ff03fa6f
SHA1

ed6ea57674ccd4c884f8af9b45d86fcf24ab9049
SHA256

3c6cf3af24c64d948f7ab638a97071c4e939f42762af12768eee3e4e22479e40
SHA512

c4bbf02d56324cddac92aa42f168df8f403f0cf1805efb2708da61b1a123c8285d8a1b04be47172518e9848fc9ffc297fa7f6787375ebb5e2d6c168ed9e4453d
SSDEEP

6144:211rg9/dHIm5gx8ISWIrPTka9ZhuGQT2+LwTdSv+qEMxpASjTnrV:2c9/um5i8ISpkcxeAF4xpASTV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2616	2576	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2616	2576	4389fadbb20f25516f6f7de2ff03fa6f.exe	29
PID 2576 wrote to memory of 2616	2576	4389fadbb20f25516f6f7de2ff03fa6f.exe	29
PID 2576 wrote to memory of 2616	2576	4389fadbb20f25516f6f7de2ff03fa6f.exe	29
PID 2576 wrote to memory of 2616	2576	4389fadbb20f25516f6f7de2ff03fa6f.exe	29

C:\Users\Admin\AppData\Local\Temp\4389fadbb20f25516f6f7de2ff03fa6f.exe
"C:\Users\Admin\AppData\Local\Temp\4389fadbb20f25516f6f7de2ff03fa6f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 116
  2⤵
  - Program crash
  PID:2616

memory/2576-0-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Filesize
384KB

Download