4b047eee9ee680841f286716409235872693ae3a5ca54acfb3280ef3307ab08c

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:39

Target

2884aa0007d1e06216565dcd15466970.exe
Size

112KB
MD5

2884aa0007d1e06216565dcd15466970
SHA1

848a311901b797782a23f8c6df766bf35827b331
SHA256

4b047eee9ee680841f286716409235872693ae3a5ca54acfb3280ef3307ab08c
SHA512

8da4222fed58609a29fc4ad4da30c2c1f61d23e1b68ecbdb1a0744f6b4cb9a86520b4e53f0daa48cb199b5013819e6db147ed46d255525f633ae3df97c4899d1
SSDEEP

1536:r2JW6/4BEzByeEoHhA8Lh7I0FlJlmBjs+WymZvVoejRGjOisGuXJ2mR2HV:ro1/nzUjcTaOlJUXWy0vaSbBXJ2m

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2340	2344	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2340	2344	2884aa0007d1e06216565dcd15466970.exe	16
PID 2344 wrote to memory of 2340	2344	2884aa0007d1e06216565dcd15466970.exe	16
PID 2344 wrote to memory of 2340	2344	2884aa0007d1e06216565dcd15466970.exe	16
PID 2344 wrote to memory of 2340	2344	2884aa0007d1e06216565dcd15466970.exe	16

C:\Users\Admin\AppData\Local\Temp\2884aa0007d1e06216565dcd15466970.exe
"C:\Users\Admin\AppData\Local\Temp\2884aa0007d1e06216565dcd15466970.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 36
  2⤵
  - Program crash
  PID:2340

memory/2344-0-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download