04413d801d90a4819112dc636e7d9ed3051410c0db59c9fb73d45a1b3ea694e9

Analysis

max time kernel
142s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 11:34

Target

17415b29d8be4ae28a668030136a634d.exe
Size

80KB
MD5

17415b29d8be4ae28a668030136a634d
SHA1

15f3283d156c4d697628ab1e830b4daccf58ae40
SHA256

04413d801d90a4819112dc636e7d9ed3051410c0db59c9fb73d45a1b3ea694e9
SHA512

1becf587b62e80ad5faa3e96940b438b76b2a504365cc506c4a536af35d3cb9777678cbe33908312cb14d288eb7e8a74f44716b2336677fbcf79da9334069d1f
SSDEEP

1536:S7lIOu89lDu+s7J8awaZtzBitegdH7hZyLmy6UMaG56q+Q3ZCrfr8iXT:+IOfC7zBitegdbhZAmy6UnR17LD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2648	2156	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2648	2156	17415b29d8be4ae28a668030136a634d.exe	28
PID 2156 wrote to memory of 2648	2156	17415b29d8be4ae28a668030136a634d.exe	28
PID 2156 wrote to memory of 2648	2156	17415b29d8be4ae28a668030136a634d.exe	28
PID 2156 wrote to memory of 2648	2156	17415b29d8be4ae28a668030136a634d.exe	28

C:\Users\Admin\AppData\Local\Temp\17415b29d8be4ae28a668030136a634d.exe
"C:\Users\Admin\AppData\Local\Temp\17415b29d8be4ae28a668030136a634d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 88
  2⤵
  - Program crash
  PID:2648

memory/2156-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download