0479e28dee58e81df2212ef274827904398b9204e5b69050b6b08a46295f356c

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:05

Target

052224582fd3c060d0c4d02a74163d64.exe
Size

389KB
MD5

052224582fd3c060d0c4d02a74163d64
SHA1

d05f3f182517dd0807f8f153329a6188ac3cbe4b
SHA256

0479e28dee58e81df2212ef274827904398b9204e5b69050b6b08a46295f356c
SHA512

4ea68a9ff5121e0d9ac3169634cb966ad761a98b09c30f75eb75dc2099fca2392978c852ca8cef337110eef96bced26beeb6c9841fd2b10ff688cd8f13560af0
SSDEEP

12288:eawKNw5PaUkBlErmSWx4X8Vx2iNpqa9vSHKHC8L/ZgR6v:6hFwkFWx4XAAuoYvJi8L/Zf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2288	1756	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2288	1756	052224582fd3c060d0c4d02a74163d64.exe	28
PID 1756 wrote to memory of 2288	1756	052224582fd3c060d0c4d02a74163d64.exe	28
PID 1756 wrote to memory of 2288	1756	052224582fd3c060d0c4d02a74163d64.exe	28
PID 1756 wrote to memory of 2288	1756	052224582fd3c060d0c4d02a74163d64.exe	28

C:\Users\Admin\AppData\Local\Temp\052224582fd3c060d0c4d02a74163d64.exe
"C:\Users\Admin\AppData\Local\Temp\052224582fd3c060d0c4d02a74163d64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 36
  2⤵
  - Program crash
  PID:2288

memory/1756-0-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download