7e79138443192dcfa0a135da730936c8b225d4a17d8b7590b699f1ba22f55b46

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-01-2024 21:35

Target

41f75ba52c2f056682d7be10a8df974f.exe
Size

119KB
MD5

41f75ba52c2f056682d7be10a8df974f
SHA1

782d33cbc33c9d807353a9dd7fc9b85780f82bfc
SHA256

7e79138443192dcfa0a135da730936c8b225d4a17d8b7590b699f1ba22f55b46
SHA512

825d245ca872572a703e08e784dd8ff4436c005a93667d9b68f73edf399945260e3b00b76597de52b0c11a667cba8b1c1cba0e6a37e8042141e3261225005f8b
SSDEEP

3072:oBvRS6OXAb/iRU1xxUic6FkHMexfTU4oinHW6ZWK+E:4xOXArpBrDyFxfXnHWGWU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2092	1172	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 2092	1172	41f75ba52c2f056682d7be10a8df974f.exe	28
PID 1172 wrote to memory of 2092	1172	41f75ba52c2f056682d7be10a8df974f.exe	28
PID 1172 wrote to memory of 2092	1172	41f75ba52c2f056682d7be10a8df974f.exe	28
PID 1172 wrote to memory of 2092	1172	41f75ba52c2f056682d7be10a8df974f.exe	28

C:\Users\Admin\AppData\Local\Temp\41f75ba52c2f056682d7be10a8df974f.exe
"C:\Users\Admin\AppData\Local\Temp\41f75ba52c2f056682d7be10a8df974f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 36
  2⤵
  - Program crash
  PID:2092

memory/1172-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1172-1-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download