4e25494bdc3c5e3b38a9a979b150f8d085d48c3e4db70d614cd3442707056003

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 02:59

Target

4e755e800e26a5b5bbd896ad7430d3af.exe
Size

422KB
MD5

4e755e800e26a5b5bbd896ad7430d3af
SHA1

ef0a814bf31bb9a919667989686c03fd875fb37d
SHA256

4e25494bdc3c5e3b38a9a979b150f8d085d48c3e4db70d614cd3442707056003
SHA512

f97d965fce3e656405c587d7a9022f42ea9b5a94c78c972854818b91aadb67fd1316ef3b4b3c08e057aecc4be1bfde9e14c6cf83bde91e5454ef711db4b1c2d0
SSDEEP

6144:ykB1INZdWaFzaE7mDGg7Y4+MFyBPys80G5sEOi9Ri9na5UVx3:ykBgdW/E7mDGg8xMkBp80GiZa5UVh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1752	2476	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 1752	2476	4e755e800e26a5b5bbd896ad7430d3af.exe	26
PID 2476 wrote to memory of 1752	2476	4e755e800e26a5b5bbd896ad7430d3af.exe	26
PID 2476 wrote to memory of 1752	2476	4e755e800e26a5b5bbd896ad7430d3af.exe	26
PID 2476 wrote to memory of 1752	2476	4e755e800e26a5b5bbd896ad7430d3af.exe	26

C:\Users\Admin\AppData\Local\Temp\4e755e800e26a5b5bbd896ad7430d3af.exe
"C:\Users\Admin\AppData\Local\Temp\4e755e800e26a5b5bbd896ad7430d3af.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 116
  2⤵
  - Program crash
  PID:1752

memory/2476-0-0x0000000000880000-0x00000000008EE000-memory.dmp

Filesize
440KB

Download