e94fb4734360a71fc2bd1d2b124f42b1ea1314f92748396e0be0bae7daeeb3b8

Analysis

max time kernel
118s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 03:27

Target

504045a770564488c62c38cbd28152b0.exe
Size

426KB
MD5

504045a770564488c62c38cbd28152b0
SHA1

67b8e95e2373cb22b19d9d7ec8d184fecfbd9cf8
SHA256

e94fb4734360a71fc2bd1d2b124f42b1ea1314f92748396e0be0bae7daeeb3b8
SHA512

c459a9bc834d38faf3c3cd59ea2002dfb167171a53196e6baccebf80d0740b0884067f63db034d20e86e4f21b845b5341ad7492a1a9d2720dfc1a550cd1b083e
SSDEEP

6144:er9rTIaL1C9Bavn6eMSPiB9ZD+gNDmxg4wUpD32whivVqya:wIaG8fPMSqBzKgcxgnQDmwhPya

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2404	2744	WerFault.exe	9

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2404	2744	504045a770564488c62c38cbd28152b0.exe	27
PID 2744 wrote to memory of 2404	2744	504045a770564488c62c38cbd28152b0.exe	27
PID 2744 wrote to memory of 2404	2744	504045a770564488c62c38cbd28152b0.exe	27
PID 2744 wrote to memory of 2404	2744	504045a770564488c62c38cbd28152b0.exe	27

C:\Users\Admin\AppData\Local\Temp\504045a770564488c62c38cbd28152b0.exe
"C:\Users\Admin\AppData\Local\Temp\504045a770564488c62c38cbd28152b0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 196
  2⤵
  - Program crash
  PID:2404

memory/2744-1-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2744-2-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download