4421c384159f43e45d56bbd9f2694ba272bfc9fdfaa0c5b188690ac68a3d7817

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 09:12

Target

3c772e04b2885f989ec8631f9bb90279.exe
Size

11KB
MD5

3c772e04b2885f989ec8631f9bb90279
SHA1

15c68a25ae36d20fa214184a6ddaca53e11afa22
SHA256

4421c384159f43e45d56bbd9f2694ba272bfc9fdfaa0c5b188690ac68a3d7817
SHA512

0b26aa2d400d51c18ab743347110e94fdc02e1689dec5527d65ba9f85cf76a400fbd9c1b3e9d9b470e694de9d91bc037ea7ad056c28b44dc51aab3fd68d17cee
SSDEEP

192:SYa2DV9JAqZBEk/U/F6PBwu2B1XirkVeVugcTXB28E1/kzN5Js7F:7ZOdi2k4xrB28E1/eNjsh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
860	2252	WerFault.exe	9

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 860	2252	3c772e04b2885f989ec8631f9bb90279.exe	16
PID 2252 wrote to memory of 860	2252	3c772e04b2885f989ec8631f9bb90279.exe	16
PID 2252 wrote to memory of 860	2252	3c772e04b2885f989ec8631f9bb90279.exe	16
PID 2252 wrote to memory of 860	2252	3c772e04b2885f989ec8631f9bb90279.exe	16

C:\Users\Admin\AppData\Local\Temp\3c772e04b2885f989ec8631f9bb90279.exe
"C:\Users\Admin\AppData\Local\Temp\3c772e04b2885f989ec8631f9bb90279.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 36
  2⤵
  - Program crash
  PID:860