4ca0a1b3448198f802794f3308630adb98c3d1d9ea85ad0f92ef260ad68e8e81

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 17:45

Target

4182db7e11a8273225303f045815c959.exe
Size

28KB
MD5

4182db7e11a8273225303f045815c959
SHA1

a3751cc1a6a2aed6a5955046f52c216ccf3bccfd
SHA256

4ca0a1b3448198f802794f3308630adb98c3d1d9ea85ad0f92ef260ad68e8e81
SHA512

60cb89513785b7a7be2b9a1c2327e7ab32e19ba560a9536d9b5890af7cc0abb61426ca938d3c616817f80f0eaa46f805c5de6d00c89193c08c8e9cccc8abe766
SSDEEP

96:nIrluC8fDXrara5BZSg+m+lbwR03DhRY3EyJK1zzUD:ncuC8fbWng+mSx3DhR6w1zID

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2416	2256	WerFault.exe	9

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2416	2256	4182db7e11a8273225303f045815c959.exe	28
PID 2256 wrote to memory of 2416	2256	4182db7e11a8273225303f045815c959.exe	28
PID 2256 wrote to memory of 2416	2256	4182db7e11a8273225303f045815c959.exe	28
PID 2256 wrote to memory of 2416	2256	4182db7e11a8273225303f045815c959.exe	28

C:\Users\Admin\AppData\Local\Temp\4182db7e11a8273225303f045815c959.exe
"C:\Users\Admin\AppData\Local\Temp\4182db7e11a8273225303f045815c959.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 88
  2⤵
  - Program crash
  PID:2416

memory/2256-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download