168fa124bf9ee7383866e304e8a9b6d111931562865c3958054cb4a2f79e3fe1

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 06:48

Target

458fce270aa1337e5efd5a9d9d96ba35.exe
Size

477KB
MD5

458fce270aa1337e5efd5a9d9d96ba35
SHA1

2a2dd739b79ae9a2c98b25e276bb7a3d5c82b69a
SHA256

168fa124bf9ee7383866e304e8a9b6d111931562865c3958054cb4a2f79e3fe1
SHA512

00c627c556f649dec809575a21b0aed3ed52bdf2afc1e83dfec7c871765804494af1eece27e165d8328dc7d67066ea8fe3bf2dd69e9d41a896197f52ce11a391
SSDEEP

12288:0E91bekzaF4rNb1iGtbwJNAV8mNCafcIso5zRroWX:0S1bJzasd1iGiJNA6Wf8ORrdX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2220	640	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 2220	640	458fce270aa1337e5efd5a9d9d96ba35.exe	16
PID 640 wrote to memory of 2220	640	458fce270aa1337e5efd5a9d9d96ba35.exe	16
PID 640 wrote to memory of 2220	640	458fce270aa1337e5efd5a9d9d96ba35.exe	16
PID 640 wrote to memory of 2220	640	458fce270aa1337e5efd5a9d9d96ba35.exe	16

C:\Users\Admin\AppData\Local\Temp\458fce270aa1337e5efd5a9d9d96ba35.exe
"C:\Users\Admin\AppData\Local\Temp\458fce270aa1337e5efd5a9d9d96ba35.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 44
  2⤵
  - Program crash
  PID:2220

memory/640-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/640-0-0x0000000000400000-0x00000000005B6000-memory.dmp

Filesize
1.7MB

Download
memory/640-2-0x0000000000400000-0x00000000005B6000-memory.dmp

Filesize
1.7MB

Download
memory/640-3-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download