4017b39473bdba37a135f2cf0df5c11b5d854b6bdf050c18b00e20b40ed4050d

Analysis

max time kernel
142s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 09:37

Target

14add1793d0b8c936c544cc8eca3f3e9.exe
Size

49KB
MD5

14add1793d0b8c936c544cc8eca3f3e9
SHA1

c92ff3de4ecc8feab52735e4f794aba8415ad667
SHA256

4017b39473bdba37a135f2cf0df5c11b5d854b6bdf050c18b00e20b40ed4050d
SHA512

0a456ae5574dbbc1503925a9167239964a8f34daac27bc3d475a1dc16d9555a71596f3964c2d815477e4f273a1023097e9aea189e0e426572e292dca251a45c9
SSDEEP

768:RM6vXHIn3W6z2SXibYPIKLiQZXVHjVRyYLv+OJxy8XBb2ffxUTQKwyIVOrpJR:RMUonmaXi/EZX9yYLxvxksyYpJR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3060	3000	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3060	3000	14add1793d0b8c936c544cc8eca3f3e9.exe	28
PID 3000 wrote to memory of 3060	3000	14add1793d0b8c936c544cc8eca3f3e9.exe	28
PID 3000 wrote to memory of 3060	3000	14add1793d0b8c936c544cc8eca3f3e9.exe	28
PID 3000 wrote to memory of 3060	3000	14add1793d0b8c936c544cc8eca3f3e9.exe	28

C:\Users\Admin\AppData\Local\Temp\14add1793d0b8c936c544cc8eca3f3e9.exe
"C:\Users\Admin\AppData\Local\Temp\14add1793d0b8c936c544cc8eca3f3e9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 152
  2⤵
  - Program crash
  PID:3060

memory/3000-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3000-1-0x0000000000220000-0x0000000000225000-memory.dmp

Filesize
20KB

Download
memory/3000-2-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download