7c7207505ac883483cc0c61b46fcfa57dfc5280b3785189f6cc71de054ec2d11

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 03:10

Target

4f2d275e487ac75113ecb8eb1d9d492b.exe
Size

487KB
MD5

4f2d275e487ac75113ecb8eb1d9d492b
SHA1

0d22eb8a7d36a6da639700457e464be17dc9c4fa
SHA256

7c7207505ac883483cc0c61b46fcfa57dfc5280b3785189f6cc71de054ec2d11
SHA512

ea8836e63fb36671773b81ef2bfed99c3fe62652db505bf332a5247ca5dadb282c2f7d8ae472c6d4a5ef7eba036d7e4c83620ece180d5e0fad357c1af7ff78d9
SSDEEP

12288:IvOos7XPOkGFQ/ujd+GMv9OaVsU86EM4ShhIAZ:IvOZ7nGm/Yd+GM1aL6EM3htZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2392	3012	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2392	3012	4f2d275e487ac75113ecb8eb1d9d492b.exe	28
PID 3012 wrote to memory of 2392	3012	4f2d275e487ac75113ecb8eb1d9d492b.exe	28
PID 3012 wrote to memory of 2392	3012	4f2d275e487ac75113ecb8eb1d9d492b.exe	28
PID 3012 wrote to memory of 2392	3012	4f2d275e487ac75113ecb8eb1d9d492b.exe	28

C:\Users\Admin\AppData\Local\Temp\4f2d275e487ac75113ecb8eb1d9d492b.exe
"C:\Users\Admin\AppData\Local\Temp\4f2d275e487ac75113ecb8eb1d9d492b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 116
  2⤵
  - Program crash
  PID:2392

memory/3012-0-0x0000000000A20000-0x0000000000A9E000-memory.dmp

Filesize
504KB

Download