16447978c3500ab420c21fafd2207b91b9f9f0e21c394b6757364c53d77029b6

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05-01-2024 14:42

Target

43f0d276b6fefd030ea29adcca497a71.exe
Size

370KB
MD5

43f0d276b6fefd030ea29adcca497a71
SHA1

bebe468875327ac9dda10a408c046256252852d8
SHA256

16447978c3500ab420c21fafd2207b91b9f9f0e21c394b6757364c53d77029b6
SHA512

9ae78b47eec5cff098cffaa82c07893b5a13bb455051fdd1f9ffe1764c7c6d072d6b870ad475bf2b46c4b54244c78140b025b9b2ad5926585c6468ff85d0c154
SSDEEP

6144:BsPtMJfPYO6ksOtk9Unf0lhk5+t5BnXE099vwEdV0h/ZE:lJoO6NOtHfkScrnX5nIW0h2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2220	2188	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2220	2188	43f0d276b6fefd030ea29adcca497a71.exe	29
PID 2188 wrote to memory of 2220	2188	43f0d276b6fefd030ea29adcca497a71.exe	29
PID 2188 wrote to memory of 2220	2188	43f0d276b6fefd030ea29adcca497a71.exe	29
PID 2188 wrote to memory of 2220	2188	43f0d276b6fefd030ea29adcca497a71.exe	29

C:\Users\Admin\AppData\Local\Temp\43f0d276b6fefd030ea29adcca497a71.exe
"C:\Users\Admin\AppData\Local\Temp\43f0d276b6fefd030ea29adcca497a71.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 132
  2⤵
  - Program crash
  PID:2220

memory/2188-0-0x0000000000D60000-0x0000000000D95000-memory.dmp

Filesize
212KB

Download
memory/2188-1-0x0000000000D60000-0x0000000000D95000-memory.dmp

Filesize
212KB

Download