4fdd4785330ec338a90a613af8157fd4e168d39fd3ca1587179f1256d4c01776

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05-01-2024 07:26

Target

431ac0b57211cbd145fa094ebcbf31ba.exe
Size

694KB
MD5

431ac0b57211cbd145fa094ebcbf31ba
SHA1

a87148b4a45f4330c7f3f8cd17be1a45823c18b8
SHA256

4fdd4785330ec338a90a613af8157fd4e168d39fd3ca1587179f1256d4c01776
SHA512

57c1e36f07de470311da00e055da95782f127beb60dce8f038f6dd92b1b97dc09c82ff4522709f194a688cff1f0a44a71fde422cd3065ad5adc2173a2ebf2cd8
SSDEEP

12288:G4DK8AXZMKlhubzt+3ExovQqZZTBRXjIjY5HUwBWGARdJy8SP:G0KLubzt+3safFRlHUwB3AhSP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2156	1716	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2156	1716	431ac0b57211cbd145fa094ebcbf31ba.exe	14
PID 1716 wrote to memory of 2156	1716	431ac0b57211cbd145fa094ebcbf31ba.exe	14
PID 1716 wrote to memory of 2156	1716	431ac0b57211cbd145fa094ebcbf31ba.exe	14
PID 1716 wrote to memory of 2156	1716	431ac0b57211cbd145fa094ebcbf31ba.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 132
1⤵
- Program crash
PID:2156

C:\Users\Admin\AppData\Local\Temp\431ac0b57211cbd145fa094ebcbf31ba.exe
"C:\Users\Admin\AppData\Local\Temp\431ac0b57211cbd145fa094ebcbf31ba.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716

memory/1716-0-0x0000000000CD0000-0x0000000000D83000-memory.dmp

Filesize
716KB

Download