796e1d5f6e4d088c94ffcdc4335218cdbf95b82d2f6cfc1aea2b9e3f98ac9bdd

Analysis

max time kernel
176s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 20:57

Target

41e56712dae6d7978d762085ba342d5e.exe
Size

76KB
MD5

41e56712dae6d7978d762085ba342d5e
SHA1

9f67768d18518a0d2916d2aed286c495150c5908
SHA256

796e1d5f6e4d088c94ffcdc4335218cdbf95b82d2f6cfc1aea2b9e3f98ac9bdd
SHA512

71abe49891d3274f5680ca1a9d6525011ab6fc3853d5faab1e6647275c99b0ea93867f3ccad6e2516f0357b373052a634fbb3f97e1cf87868208b40a742fb35a
SSDEEP

1536:C/ePyXHZ7DA4BfBrmTiXvvvUgbFNCuACP1DIgN:oeSHZ7DTBfBrB/UgbFNCuAq2C

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2672	2588	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 2672	2588	41e56712dae6d7978d762085ba342d5e.exe	29
PID 2588 wrote to memory of 2672	2588	41e56712dae6d7978d762085ba342d5e.exe	29
PID 2588 wrote to memory of 2672	2588	41e56712dae6d7978d762085ba342d5e.exe	29
PID 2588 wrote to memory of 2672	2588	41e56712dae6d7978d762085ba342d5e.exe	29

C:\Users\Admin\AppData\Local\Temp\41e56712dae6d7978d762085ba342d5e.exe
"C:\Users\Admin\AppData\Local\Temp\41e56712dae6d7978d762085ba342d5e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 108
  2⤵
  - Program crash
  PID:2672

memory/2588-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2588-1-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download