973381b94a80b0d1620a4d2f6458d6439261251ffca59d6df8c287125992f2cf

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 02:52

Target

4dfd60735b6855bef6b17a07e14c8e33.exe
Size

430KB
MD5

4dfd60735b6855bef6b17a07e14c8e33
SHA1

dcf99e8fded3b6690673179491c798420aa1fac9
SHA256

973381b94a80b0d1620a4d2f6458d6439261251ffca59d6df8c287125992f2cf
SHA512

21635974eb3d66f77364dc88967459d0fc341f2e414a27af6db97d30f09e796d71cad9354a317e80aa552136e7d845fc35940eb5df060eba05accaa09cb3d827
SSDEEP

6144:Ulsy4TNbEm1B1zzqaCh9Ju/2x+vw0b8ajNglS2+gUXpP9YC4r:UdwNIm1B1zzqrh9Jf+btwSfgUnBI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3028	2924	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 3028	2924	4dfd60735b6855bef6b17a07e14c8e33.exe	28
PID 2924 wrote to memory of 3028	2924	4dfd60735b6855bef6b17a07e14c8e33.exe	28
PID 2924 wrote to memory of 3028	2924	4dfd60735b6855bef6b17a07e14c8e33.exe	28
PID 2924 wrote to memory of 3028	2924	4dfd60735b6855bef6b17a07e14c8e33.exe	28

C:\Users\Admin\AppData\Local\Temp\4dfd60735b6855bef6b17a07e14c8e33.exe
"C:\Users\Admin\AppData\Local\Temp\4dfd60735b6855bef6b17a07e14c8e33.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 116
  2⤵
  - Program crash
  PID:3028

memory/2924-0-0x0000000000B20000-0x0000000000B90000-memory.dmp

Filesize
448KB

Download