e9419b49f7aeff1da67dae2c91de49d7753c420ca6a9c19b926be7dfd48c3062

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:39

Target

204e7fa4b2b4bc66e0c53fd4b100dcf8.exe
Size

159KB
MD5

204e7fa4b2b4bc66e0c53fd4b100dcf8
SHA1

a4a1f7ac42c20e8c8b17776d373b19f3052055ef
SHA256

e9419b49f7aeff1da67dae2c91de49d7753c420ca6a9c19b926be7dfd48c3062
SHA512

05911d09f960902eab4e6933cc66fc377d1ab98f20eb9830e68c7b5685d85025b2fe132199553886ec529ae8c026b6feaa7ed0eb054519cc272d14e869250ad4
SSDEEP

3072:fgzF5C9Az8U0VRVSw2ZI6EssQ3llZaKZQQ3VmiDcxI+ys4qAK:osVRL2ZTwQVlVZQU4VxI+QqT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
864	3052	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 864	3052	204e7fa4b2b4bc66e0c53fd4b100dcf8.exe	28
PID 3052 wrote to memory of 864	3052	204e7fa4b2b4bc66e0c53fd4b100dcf8.exe	28
PID 3052 wrote to memory of 864	3052	204e7fa4b2b4bc66e0c53fd4b100dcf8.exe	28
PID 3052 wrote to memory of 864	3052	204e7fa4b2b4bc66e0c53fd4b100dcf8.exe	28

C:\Users\Admin\AppData\Local\Temp\204e7fa4b2b4bc66e0c53fd4b100dcf8.exe
"C:\Users\Admin\AppData\Local\Temp\204e7fa4b2b4bc66e0c53fd4b100dcf8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 280
  2⤵
  - Program crash
  PID:864

memory/3052-1-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/3052-2-0x0000000000270000-0x00000000002B7000-memory.dmp

Filesize
284KB

Download
memory/3052-3-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/3052-5-0x0000000000470000-0x000000000049E000-memory.dmp

Filesize
184KB

Download
memory/3052-4-0x0000000000230000-0x0000000000235000-memory.dmp

Filesize
20KB

Download
memory/3052-6-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/3052-8-0x0000000000270000-0x00000000002B7000-memory.dmp

Filesize
284KB

Download