67df1473f298922d77ea5dab2312a3c3506f8abc2a887dd7062a7024bbdf9185

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 21:42

Target

04b3dda435a73805850bd487501e9ae4.exe
Size

367KB
MD5

04b3dda435a73805850bd487501e9ae4
SHA1

d834045b7cdf03b403b4daa0569ef6661361fb6e
SHA256

67df1473f298922d77ea5dab2312a3c3506f8abc2a887dd7062a7024bbdf9185
SHA512

37ab831f4b95383a463b60435a4071c11b037f098d3e23d82dfe1a93ac521aac9edb58143f075b460ac074bdb651a1f2c32c214100c813213e2099c7ea7c92b8
SSDEEP

6144:rpEcAd/Mm5ZkyUneRTnJOmQ4W4/6zA5K0TzJRCp4xRvKUllD/W13+e:rTAOm5eyUnJmCzAXTzJR3RvK6lCwe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2180	1464	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 2180	1464	04b3dda435a73805850bd487501e9ae4.exe	15
PID 1464 wrote to memory of 2180	1464	04b3dda435a73805850bd487501e9ae4.exe	15
PID 1464 wrote to memory of 2180	1464	04b3dda435a73805850bd487501e9ae4.exe	15
PID 1464 wrote to memory of 2180	1464	04b3dda435a73805850bd487501e9ae4.exe	15

C:\Users\Admin\AppData\Local\Temp\04b3dda435a73805850bd487501e9ae4.exe
"C:\Users\Admin\AppData\Local\Temp\04b3dda435a73805850bd487501e9ae4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 116
  2⤵
  - Program crash
  PID:2180

memory/1464-0-0x0000000000F30000-0x0000000000F90000-memory.dmp

Filesize
384KB

Download