b67d3b8cbdb06cfcf005207fd48d34636dc5e441ab129daaa692e4c3999c9b0b

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 00:26

Target

46484003ea39776318f0d50fae85eac8.exe
Size

321KB
MD5

46484003ea39776318f0d50fae85eac8
SHA1

8bd3d8cac80218935d0b4f564cad305c22ea9e12
SHA256

b67d3b8cbdb06cfcf005207fd48d34636dc5e441ab129daaa692e4c3999c9b0b
SHA512

a6dfcfe82c1009abe29cc0e86b786629660e369b97903f993e3daee31bd464f1b8d800c29705300563699215227110360bf4cc6591cd58c0dc610aeaccafc3c2
SSDEEP

6144:OTj1OTEKnsub1upoH7td/tQqG56Prd3Z5NBA3r14lJDNIl:OFOoKnsub6oHprG5+3a7STY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1916	2360	WerFault.exe	10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1916	2360	46484003ea39776318f0d50fae85eac8.exe	28
PID 2360 wrote to memory of 1916	2360	46484003ea39776318f0d50fae85eac8.exe	28
PID 2360 wrote to memory of 1916	2360	46484003ea39776318f0d50fae85eac8.exe	28
PID 2360 wrote to memory of 1916	2360	46484003ea39776318f0d50fae85eac8.exe	28

C:\Users\Admin\AppData\Local\Temp\46484003ea39776318f0d50fae85eac8.exe
"C:\Users\Admin\AppData\Local\Temp\46484003ea39776318f0d50fae85eac8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 116
  2⤵
  - Program crash
  PID:1916

memory/2360-0-0x0000000001260000-0x00000000012B5000-memory.dmp

Filesize
340KB

Download