667e268e8f97eeda13349fc9238403fb4f38195f15dff6889783e4ab4ba03103

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-01-2024 20:02

Target

41c888bb280de209d5c736d784cba4af.exe
Size

152KB
MD5

41c888bb280de209d5c736d784cba4af
SHA1

170e44157cf587183202924448562287f1e98028
SHA256

667e268e8f97eeda13349fc9238403fb4f38195f15dff6889783e4ab4ba03103
SHA512

238b60661cf8700657425d191c0263a28986a8d5489acc0a249cd87a8cc9603784d2f88552e5a862413a07fb8f3c88899392bf82e9ee30be7c3c27396a98c1bf
SSDEEP

768:eY3GDcYWHTcA2pm+PuMVV3Lb8XzZjXQV7V9dW7g38WxBSiXdKymgJoccY:eY2Q1z0pPuOVbwXGV9deg38KNXA2ocV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1320	1820	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 1320	1820	41c888bb280de209d5c736d784cba4af.exe	28
PID 1820 wrote to memory of 1320	1820	41c888bb280de209d5c736d784cba4af.exe	28
PID 1820 wrote to memory of 1320	1820	41c888bb280de209d5c736d784cba4af.exe	28
PID 1820 wrote to memory of 1320	1820	41c888bb280de209d5c736d784cba4af.exe	28

C:\Users\Admin\AppData\Local\Temp\41c888bb280de209d5c736d784cba4af.exe
"C:\Users\Admin\AppData\Local\Temp\41c888bb280de209d5c736d784cba4af.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 124
  2⤵
  - Program crash
  PID:1320