e4fc9812ce30f11fb6292afcee333cd516b68b19a770118788475e196eab4b15

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 00:28

Target

4674f6217b7da093838a3f241de8c546.exe
Size

112KB
MD5

4674f6217b7da093838a3f241de8c546
SHA1

8938a61b7ec09db50b9ae4d67ceb494e59bd2ae9
SHA256

e4fc9812ce30f11fb6292afcee333cd516b68b19a770118788475e196eab4b15
SHA512

dec1d86ffdd9119327b6bc0503e6fcbaa907a3dc3755865b3bfb655bba3346c035df41eb5dc83559f780c322e8245f30e0dcc6923e6955c0d36b14babea644e9
SSDEEP

1536:ZVZnxm6MG9xgfrvEaoiT/GyphjXDYjKwttoswRmhApEjD0N9Y6js+uTAbe:pnxwgxgfR/DVG7wBpEsNDj4A

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2084	2140	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2084	2140	4674f6217b7da093838a3f241de8c546.exe	28
PID 2140 wrote to memory of 2084	2140	4674f6217b7da093838a3f241de8c546.exe	28
PID 2140 wrote to memory of 2084	2140	4674f6217b7da093838a3f241de8c546.exe	28
PID 2140 wrote to memory of 2084	2140	4674f6217b7da093838a3f241de8c546.exe	28

C:\Users\Admin\AppData\Local\Temp\4674f6217b7da093838a3f241de8c546.exe
"C:\Users\Admin\AppData\Local\Temp\4674f6217b7da093838a3f241de8c546.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 100
  2⤵
  - Program crash
  PID:2084

memory/2140-0-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download