29f68ec7ecf6684edf654f9986bfc03f9a36265827261fbdb97d348d4e5d39c7

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 00:00

Target

44e307f2d7c7c66e19c1c2d65a6e3041.exe
Size

699KB
MD5

44e307f2d7c7c66e19c1c2d65a6e3041
SHA1

c3375c66ff1e13ca02fd332b14ed231d0e6cdd68
SHA256

29f68ec7ecf6684edf654f9986bfc03f9a36265827261fbdb97d348d4e5d39c7
SHA512

ab8efb7ab6be3eda11902e6b5a8b7f549a790bd2d9e61efea5d4aa3662a2e53eddb8d78d0d522480484bb2cdd63beb60f5e626623acc9b1ee5f19110993b4094
SSDEEP

12288:TX+pd167QhE0s7+jM+M6ugRfMMkIM7tX+pd167QhE0S7+oQwxYqXfawJd:TE6Ehg7mM+M6RkMkIM7tE6Ehm7Iwfasd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2424	2908	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2424	2908	44e307f2d7c7c66e19c1c2d65a6e3041.exe	28
PID 2908 wrote to memory of 2424	2908	44e307f2d7c7c66e19c1c2d65a6e3041.exe	28
PID 2908 wrote to memory of 2424	2908	44e307f2d7c7c66e19c1c2d65a6e3041.exe	28
PID 2908 wrote to memory of 2424	2908	44e307f2d7c7c66e19c1c2d65a6e3041.exe	28

C:\Users\Admin\AppData\Local\Temp\44e307f2d7c7c66e19c1c2d65a6e3041.exe
"C:\Users\Admin\AppData\Local\Temp\44e307f2d7c7c66e19c1c2d65a6e3041.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 164
  2⤵
  - Program crash
  PID:2424

memory/2908-0-0x0000000000B50000-0x0000000000BFF000-memory.dmp

Filesize
700KB

Download