ef5c03152b531cabeed7d9474f27c2b2068124edddffcbd3aba41edc7f768b4e

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 02:35

Target

450d675d6bb5cfb66ec0a2602b015ec1.exe
Size

53KB
MD5

450d675d6bb5cfb66ec0a2602b015ec1
SHA1

fab67510e10d7ab736530df0c9794c1caa3c25a3
SHA256

ef5c03152b531cabeed7d9474f27c2b2068124edddffcbd3aba41edc7f768b4e
SHA512

6be7c314461a30eaa55b50c1b47fa203b6a35734e95cfea2e0b0db214afa268898a9e729d5fb4ae83f96379ca0d21345528b3462caddb8810dcdb59866889ba7
SSDEEP

768:yYC1JPrwH/DUtU8unFN3SY0hk2JMZbbce0dRJZZbsFek+pYaOtBNCtYcFwVc6K:yYC1in6WqbZkLt/uwVcl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2636	1300	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 2636	1300	450d675d6bb5cfb66ec0a2602b015ec1.exe	29
PID 1300 wrote to memory of 2636	1300	450d675d6bb5cfb66ec0a2602b015ec1.exe	29
PID 1300 wrote to memory of 2636	1300	450d675d6bb5cfb66ec0a2602b015ec1.exe	29
PID 1300 wrote to memory of 2636	1300	450d675d6bb5cfb66ec0a2602b015ec1.exe	29

C:\Users\Admin\AppData\Local\Temp\450d675d6bb5cfb66ec0a2602b015ec1.exe
"C:\Users\Admin\AppData\Local\Temp\450d675d6bb5cfb66ec0a2602b015ec1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 576
  2⤵
  - Program crash
  PID:2636

memory/1300-0-0x00000000740E0000-0x00000000747CE000-memory.dmp

Filesize
6.9MB

Download
memory/1300-1-0x00000000003B0000-0x00000000003C2000-memory.dmp

Filesize
72KB

Download
memory/1300-2-0x00000000740E0000-0x00000000747CE000-memory.dmp

Filesize
6.9MB

Download