4a3525ea302b72c4bc971406234ed1d719278eab54341c9aab163bbb62938a4f

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 15:29

Target

296f8b11db6d924ea34b79d2566022c6.exe
Size

368KB
MD5

296f8b11db6d924ea34b79d2566022c6
SHA1

4bdab312375aada0da35e76a07af2b7c9e0a588c
SHA256

4a3525ea302b72c4bc971406234ed1d719278eab54341c9aab163bbb62938a4f
SHA512

2c6183eea5a132fd81fb0aa34c66f424550c69c1277ddca16b294dc05449fc5f38101fb0228071ab3c84cc3a20c60e2426594d8f71c6fe53764a89f523a1b423
SSDEEP

6144:RTAp4naqm5GR/0N4Ftn6vicI8qtQQenKDFujBeqSDgzB8jk3B:R041m5Q/0N4L9xYus1NSD2Cg3B

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1948	2660	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 1948	2660	296f8b11db6d924ea34b79d2566022c6.exe	28
PID 2660 wrote to memory of 1948	2660	296f8b11db6d924ea34b79d2566022c6.exe	28
PID 2660 wrote to memory of 1948	2660	296f8b11db6d924ea34b79d2566022c6.exe	28
PID 2660 wrote to memory of 1948	2660	296f8b11db6d924ea34b79d2566022c6.exe	28

C:\Users\Admin\AppData\Local\Temp\296f8b11db6d924ea34b79d2566022c6.exe
"C:\Users\Admin\AppData\Local\Temp\296f8b11db6d924ea34b79d2566022c6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 116
  2⤵
  - Program crash
  PID:1948

memory/2660-0-0x0000000000820000-0x0000000000880000-memory.dmp

Filesize
384KB

Download