365b8f7e30c31abec5e6ad59a1592448732bff507333ff80648cf45be07ecc0f

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 01:23

Target

4905b07fb14b5f9782a5e336cf8be546.exe
Size

428KB
MD5

4905b07fb14b5f9782a5e336cf8be546
SHA1

a5e12d991027dbf50dd38afec8de0504997a68b2
SHA256

365b8f7e30c31abec5e6ad59a1592448732bff507333ff80648cf45be07ecc0f
SHA512

6eccbbeedd4827dea1403203710f7e4f32ac5751b7e0db667d75177effedd0e1b2007f91bb47ea4c99c73d59b79f911d7169489ccc0c697ada3124953bd83923
SSDEEP

6144:Ulsy4TNbEm1B1zzqaCh9Ju/2x+vw0b8ajNglS2+gUXpP9YC4rJ:UdwNIm1B1zzqrh9Jf+btwSfgUnBIJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2120	1380	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 2120	1380	4905b07fb14b5f9782a5e336cf8be546.exe	28
PID 1380 wrote to memory of 2120	1380	4905b07fb14b5f9782a5e336cf8be546.exe	28
PID 1380 wrote to memory of 2120	1380	4905b07fb14b5f9782a5e336cf8be546.exe	28
PID 1380 wrote to memory of 2120	1380	4905b07fb14b5f9782a5e336cf8be546.exe	28

C:\Users\Admin\AppData\Local\Temp\4905b07fb14b5f9782a5e336cf8be546.exe
"C:\Users\Admin\AppData\Local\Temp\4905b07fb14b5f9782a5e336cf8be546.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 116
  2⤵
  - Program crash
  PID:2120

memory/1380-0-0x0000000000C20000-0x0000000000C90000-memory.dmp

Filesize
448KB

Download