c69a5a0a3b6274e56787cc46e314f153ac26484f3c957d79d5dcd369c4a9a82e

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 19:46

Target

3914f1aeae61321910204b3415e11795.exe
Size

422KB
MD5

3914f1aeae61321910204b3415e11795
SHA1

dafa5694e6bb71facbbedfb9136fb978604399e0
SHA256

c69a5a0a3b6274e56787cc46e314f153ac26484f3c957d79d5dcd369c4a9a82e
SHA512

364971d4a4c95b68d71cb8707ff018408407d1dce8eaeabe82b7ef37294686dae5eb1bc2dbbc91dfd3461a34b7417251831dcd4a5557ca6f26c65f4392b8c9b7
SSDEEP

6144:ykB1INZdWaFzaE7mDGg7Y4+MFyBPys80G5sEOi9Ri9na5UVx3:ykBgdW/E7mDGg8xMkBp80GiZa5UVh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3044	776	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 3044	776	3914f1aeae61321910204b3415e11795.exe	28
PID 776 wrote to memory of 3044	776	3914f1aeae61321910204b3415e11795.exe	28
PID 776 wrote to memory of 3044	776	3914f1aeae61321910204b3415e11795.exe	28
PID 776 wrote to memory of 3044	776	3914f1aeae61321910204b3415e11795.exe	28

C:\Users\Admin\AppData\Local\Temp\3914f1aeae61321910204b3415e11795.exe
"C:\Users\Admin\AppData\Local\Temp\3914f1aeae61321910204b3415e11795.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 116
  2⤵
  - Program crash
  PID:3044

memory/776-0-0x00000000013B0000-0x000000000141E000-memory.dmp

Filesize
440KB

Download