f5bcbb48aa73e014c45326dd06f269b4c58364b0ce695c72caa315f480587b7c

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 18:31

Target

4423f9f8a75eb8cf615fa44dfdbcfc1c.exe
Size

215KB
MD5

4423f9f8a75eb8cf615fa44dfdbcfc1c
SHA1

d158bfaacc5c0bc7f5a03837447388bdd6b00b99
SHA256

f5bcbb48aa73e014c45326dd06f269b4c58364b0ce695c72caa315f480587b7c
SHA512

a397f8a289fbd502ddc76e59ff060c41acff08e4a11dd15c714a4b9060a98cb4252981c1e5b806fd2f5e36598c8a17a791195476de96d8df6ac43b26be6f9622
SSDEEP

3072:o+FDzK71QkbstyJjCKICpC72s/mlaXqMjH+jJ6NRoi0Ow7FhAXdj8H4D:o+I713bstyJj0sC7/Hjj2J6NwBhqj8M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2228	840	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2228	840	4423f9f8a75eb8cf615fa44dfdbcfc1c.exe	28
PID 840 wrote to memory of 2228	840	4423f9f8a75eb8cf615fa44dfdbcfc1c.exe	28
PID 840 wrote to memory of 2228	840	4423f9f8a75eb8cf615fa44dfdbcfc1c.exe	28
PID 840 wrote to memory of 2228	840	4423f9f8a75eb8cf615fa44dfdbcfc1c.exe	28

C:\Users\Admin\AppData\Local\Temp\4423f9f8a75eb8cf615fa44dfdbcfc1c.exe
"C:\Users\Admin\AppData\Local\Temp\4423f9f8a75eb8cf615fa44dfdbcfc1c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 124
  2⤵
  - Program crash
  PID:2228

memory/840-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download