bc5c9d7a50168b8f84b991e5badf1060d1c85808fba53b321233abcfad725b09

Analysis

max time kernel
120s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 08:24

Target

405e69d9dbc37952a72106fc409398b5.exe
Size

256KB
MD5

405e69d9dbc37952a72106fc409398b5
SHA1

df69e170d557f92ff20bf9b98170f970821f3de4
SHA256

bc5c9d7a50168b8f84b991e5badf1060d1c85808fba53b321233abcfad725b09
SHA512

05169de6f62f83bbfd35f7cca2dbcf6574dafd7959fa94c72f40346bb33b96ddf6caa44b1461adcb0d3d8cd3205eaf29622b25e998019e42dcac1502bae9261f
SSDEEP

6144:G6gI4u6lXnxh65QxwYXXwRV4PmTH9dcMf6QFoYKgB:Gq4hxhQQxwYXXwRV4OBFoCB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2140	276	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 276 wrote to memory of 2140	276	405e69d9dbc37952a72106fc409398b5.exe	29
PID 276 wrote to memory of 2140	276	405e69d9dbc37952a72106fc409398b5.exe	29
PID 276 wrote to memory of 2140	276	405e69d9dbc37952a72106fc409398b5.exe	29
PID 276 wrote to memory of 2140	276	405e69d9dbc37952a72106fc409398b5.exe	29

C:\Users\Admin\AppData\Local\Temp\405e69d9dbc37952a72106fc409398b5.exe
"C:\Users\Admin\AppData\Local\Temp\405e69d9dbc37952a72106fc409398b5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 276 -s 172
  2⤵
  - Program crash
  PID:2140

memory/276-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download