407cc3431d892fe2537175b4b6a31e2bf14ae483161de5f8988244d62f63aadd

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:12

Target

1f9949b49db90feb4f8fac5a77e84d1c.exe
Size

42KB
MD5

1f9949b49db90feb4f8fac5a77e84d1c
SHA1

283eacdf1214775f6792ed93110e1b93166f3de0
SHA256

407cc3431d892fe2537175b4b6a31e2bf14ae483161de5f8988244d62f63aadd
SHA512

d4b2c508017cc4450fa233e958f9fcdeb7413cd5a1be5b691f5db5da9d9e3ab1e4360cead3bbca2b50a631f7704c97c71fa6e77773fea2f160a1e4b3e76594cd
SSDEEP

768:Gp1G8xu4rko3uIzfC20zi/KTfQC+rsW/VTu2qIbNwGw4:GjG80mP3uMfFx/kIC+VtynIbz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2932	2864	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2932	2864	1f9949b49db90feb4f8fac5a77e84d1c.exe	15
PID 2864 wrote to memory of 2932	2864	1f9949b49db90feb4f8fac5a77e84d1c.exe	15
PID 2864 wrote to memory of 2932	2864	1f9949b49db90feb4f8fac5a77e84d1c.exe	15
PID 2864 wrote to memory of 2932	2864	1f9949b49db90feb4f8fac5a77e84d1c.exe	15

C:\Users\Admin\AppData\Local\Temp\1f9949b49db90feb4f8fac5a77e84d1c.exe
"C:\Users\Admin\AppData\Local\Temp\1f9949b49db90feb4f8fac5a77e84d1c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 88
  2⤵
  - Program crash
  PID:2932

memory/2864-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download