7ad5a463f47d571abb378d1385a1a063e4fad2376bf26a4c03478516b354d1a5

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 11:40

Target

40c3d81e3f002d6b2855774f021f676c.exe
Size

129KB
MD5

40c3d81e3f002d6b2855774f021f676c
SHA1

9986824de7f68b5535d85e9c190533c2c3a507f2
SHA256

7ad5a463f47d571abb378d1385a1a063e4fad2376bf26a4c03478516b354d1a5
SHA512

0f8d7af6c2a82aef401797c7eff40c48501ff682445eb9f5df7f13039b2f43a044df482801b6657ce717bab39238914ba4d8e1d6cd469ca101d80be5ac1c957c
SSDEEP

1536:0Nc5gxi6ISjJ//KrvO9i6pndE/SdX8g6jSJ+/KwizLQpL0GsHg78s5fBusXXRWFe:0Nc8urcdr6jSJGPr15p5q1SMCKXSBAFa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2532	1812	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2532	1812	40c3d81e3f002d6b2855774f021f676c.exe	28
PID 1812 wrote to memory of 2532	1812	40c3d81e3f002d6b2855774f021f676c.exe	28
PID 1812 wrote to memory of 2532	1812	40c3d81e3f002d6b2855774f021f676c.exe	28
PID 1812 wrote to memory of 2532	1812	40c3d81e3f002d6b2855774f021f676c.exe	28

C:\Users\Admin\AppData\Local\Temp\40c3d81e3f002d6b2855774f021f676c.exe
"C:\Users\Admin\AppData\Local\Temp\40c3d81e3f002d6b2855774f021f676c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 36
  2⤵
  - Program crash
  PID:2532

memory/1812-0-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download