4999a7346d3084218f6edd88109057bd60a5560fa042eb3b2f3951270a315091

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 00:31

Target

1d174c9edf6e97585c96b9550dec5300.exe
Size

427KB
MD5

1d174c9edf6e97585c96b9550dec5300
SHA1

fc490965572515dcc5f2e831cbc412446926262d
SHA256

4999a7346d3084218f6edd88109057bd60a5560fa042eb3b2f3951270a315091
SHA512

794d3d980638fd5c55b0c91bb7672ec76be2bd097fbd3aad3e7c120288bca613db3958552a9a46d1a82c14095c29bf01e24ffeade3f56cb2eda3a446bee16114
SSDEEP

6144:aiFUvYoYDm5v8DJtBTd8dbVTh2adDWAzuroj3zjlYL1Q3Rn:aigYLm5EDJtBJ8hrlurovhfRn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3020	2904	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 3020	2904	1d174c9edf6e97585c96b9550dec5300.exe	28
PID 2904 wrote to memory of 3020	2904	1d174c9edf6e97585c96b9550dec5300.exe	28
PID 2904 wrote to memory of 3020	2904	1d174c9edf6e97585c96b9550dec5300.exe	28
PID 2904 wrote to memory of 3020	2904	1d174c9edf6e97585c96b9550dec5300.exe	28

C:\Users\Admin\AppData\Local\Temp\1d174c9edf6e97585c96b9550dec5300.exe
"C:\Users\Admin\AppData\Local\Temp\1d174c9edf6e97585c96b9550dec5300.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 116
  2⤵
  - Program crash
  PID:3020

memory/2904-0-0x0000000000DC0000-0x0000000000E2F000-memory.dmp

Filesize
444KB

Download