3a741416f57a7458a449373a65c8c4039df167e0870993bbbcb0f70dc8b3a0fe

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 23:52

Target

44713417d2526f6046ff8a5918eb8f9d.exe
Size

32KB
MD5

44713417d2526f6046ff8a5918eb8f9d
SHA1

f3275e03d6690227dbebf8924988043379f26a13
SHA256

3a741416f57a7458a449373a65c8c4039df167e0870993bbbcb0f70dc8b3a0fe
SHA512

1bf2c2d4ef93dba79dfb1dfddece7ccc3affec2161e33ebc9629a21930f519238326b99bf4ef027a7aa2675e836f7be29ef4712b5223dde11d0d0d1d3868b55f
SSDEEP

384:gQk/yB8ODuXeNLv28T4r+y740mb+4ds0WRakkMU2mUYQqhnRW7:Nk/A8ZeNLvM+i4Z+4bCksnYPhRW7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2240	816	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 2240	816	44713417d2526f6046ff8a5918eb8f9d.exe	28
PID 816 wrote to memory of 2240	816	44713417d2526f6046ff8a5918eb8f9d.exe	28
PID 816 wrote to memory of 2240	816	44713417d2526f6046ff8a5918eb8f9d.exe	28
PID 816 wrote to memory of 2240	816	44713417d2526f6046ff8a5918eb8f9d.exe	28

C:\Users\Admin\AppData\Local\Temp\44713417d2526f6046ff8a5918eb8f9d.exe
"C:\Users\Admin\AppData\Local\Temp\44713417d2526f6046ff8a5918eb8f9d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 88
  2⤵
  - Program crash
  PID:2240

memory/816-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download