aad459b2da1fe28078f8d167cd039b194b6686ef51a6c3a5a9d5e4b4b77e0d8a

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 23:49

Target

477bc2cbcec96b57234696409fb99d11.exe
Size

6KB
MD5

477bc2cbcec96b57234696409fb99d11
SHA1

0d9e01bb3d599fe964fba3563c5ee648fbd57060
SHA256

aad459b2da1fe28078f8d167cd039b194b6686ef51a6c3a5a9d5e4b4b77e0d8a
SHA512

5e9d855704dcebc931f7f1cbe7b72749ab79265081e4d5fdfee3210e2c79fdf21fd191df462a68393d065f2834bcdacbfe65f31b162830457ea23b9fe91ac36a
SSDEEP

192:hH6zn30eLxyNR9uy/QuhYl6TB/aWugQ8WoLD:hk3dLyUuhk6daWHWI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
792	2028	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 792	2028	477bc2cbcec96b57234696409fb99d11.exe	28
PID 2028 wrote to memory of 792	2028	477bc2cbcec96b57234696409fb99d11.exe	28
PID 2028 wrote to memory of 792	2028	477bc2cbcec96b57234696409fb99d11.exe	28
PID 2028 wrote to memory of 792	2028	477bc2cbcec96b57234696409fb99d11.exe	28

C:\Users\Admin\AppData\Local\Temp\477bc2cbcec96b57234696409fb99d11.exe
"C:\Users\Admin\AppData\Local\Temp\477bc2cbcec96b57234696409fb99d11.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 128
  2⤵
  - Program crash
  PID:792

memory/2028-0-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2028-1-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2028-2-0x0000000076CF0000-0x0000000076D37000-memory.dmp

Filesize
284KB

Download
memory/2028-3-0x0000000077620000-0x0000000077621000-memory.dmp

Filesize
4KB

Download
memory/2028-4-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2028-5-0x000000007761F000-0x0000000077620000-memory.dmp

Filesize
4KB

Download
memory/2028-7-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download