4e2beae563f40a00265af2bc4671eff35f735be0306173e7d74f1ec38f7828db

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:34

Target

2605753e4ddeea29de7c603209913f77.exe
Size

488KB
MD5

2605753e4ddeea29de7c603209913f77
SHA1

e8d3382cec5d9504f2aabbaa2aa0ec40ba5b2729
SHA256

4e2beae563f40a00265af2bc4671eff35f735be0306173e7d74f1ec38f7828db
SHA512

84132ef646485612b08ea8e231777bbc47c84747d0f091ceb7ae1eb298f35db94fc635a458ba99fb074cf1b4e83b40fe2791fdc333cf79475a80177a2972d07a
SSDEEP

12288:IvOos7XPOkGFQ/ujd+GMv9OaVsU86EM4ShhIAU:IvOZ7nGm/Yd+GM1aL6EM3htU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2124	2280	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2124	2280	2605753e4ddeea29de7c603209913f77.exe	1
PID 2280 wrote to memory of 2124	2280	2605753e4ddeea29de7c603209913f77.exe	1
PID 2280 wrote to memory of 2124	2280	2605753e4ddeea29de7c603209913f77.exe	1
PID 2280 wrote to memory of 2124	2280	2605753e4ddeea29de7c603209913f77.exe	1

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 116
1⤵
- Program crash
PID:2124

C:\Users\Admin\AppData\Local\Temp\2605753e4ddeea29de7c603209913f77.exe
"C:\Users\Admin\AppData\Local\Temp\2605753e4ddeea29de7c603209913f77.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2280

memory/2280-0-0x0000000001280000-0x00000000012FE000-memory.dmp

Filesize
504KB

Download