6d2af6357e8c210c38613c6e5aa2ea017993474ee8e8dde3a9819595c5663458

Analysis

max time kernel
188s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 14:13

Target

4112ad12c036d87ffe9241d9ad0e4581.exe
Size

118KB
MD5

4112ad12c036d87ffe9241d9ad0e4581
SHA1

1ed17ab88cfd3732e2170e368f2964c8de92bb99
SHA256

6d2af6357e8c210c38613c6e5aa2ea017993474ee8e8dde3a9819595c5663458
SHA512

7d49daee23cf1739d0c82c155164667402d9259c77f3610e39c2546f80c4c3bcbf5a6e8a7c3845dc074cf9f97effdb9d9a3d0cf8c19064a6d64f90c304471c73
SSDEEP

3072:4z4IJqdICzx7lombP2KzV70CIiOxMUuyjqz3hAdZo4WjHlYXkX6FV:UKKCzpf6cTINxMUCIoJH0s6X

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2516	2900	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2516	2900	4112ad12c036d87ffe9241d9ad0e4581.exe	29
PID 2900 wrote to memory of 2516	2900	4112ad12c036d87ffe9241d9ad0e4581.exe	29
PID 2900 wrote to memory of 2516	2900	4112ad12c036d87ffe9241d9ad0e4581.exe	29
PID 2900 wrote to memory of 2516	2900	4112ad12c036d87ffe9241d9ad0e4581.exe	29

C:\Users\Admin\AppData\Local\Temp\4112ad12c036d87ffe9241d9ad0e4581.exe
"C:\Users\Admin\AppData\Local\Temp\4112ad12c036d87ffe9241d9ad0e4581.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 176
  2⤵
  - Program crash
  PID:2516

memory/2900-0-0x0000000000400000-0x000000000078E000-memory.dmp

Filesize
3.6MB

Download
memory/2900-1-0x00000000021D0000-0x00000000022E0000-memory.dmp

Filesize
1.1MB

Download
memory/2900-3-0x0000000000400000-0x000000000078E000-memory.dmp

Filesize
3.6MB

Download
memory/2900-5-0x00000000021D0000-0x00000000022E0000-memory.dmp

Filesize
1.1MB

Download