79003e8480d51135c7732713d4c903de1b74b1c82245f412a50f9c97f07d9363

Analysis

max time kernel
120s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 14:55

Target

46842dada4cb041de43bee6d2cec7fd6.exe
Size

24KB
MD5

46842dada4cb041de43bee6d2cec7fd6
SHA1

c945e3b5d3e1f51982f5df2706c20450241d805a
SHA256

79003e8480d51135c7732713d4c903de1b74b1c82245f412a50f9c97f07d9363
SHA512

ac8f5e54a826887a67a20549fa5bf36ba6965d2fd789ce265ae6a5f54ed4b376ad7a5a47fdf5e162e47389bf997d4c34f33013a7df790a48fb45e31ee333b4ca
SSDEEP

384:tbtkmecKWmEOez5GjQigS9BAjbc1FgIoWSwvELKMtZFtLU/aS:Vb0iEgdjbczgnWSoM/U

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3028	1708	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 3028	1708	46842dada4cb041de43bee6d2cec7fd6.exe	28
PID 1708 wrote to memory of 3028	1708	46842dada4cb041de43bee6d2cec7fd6.exe	28
PID 1708 wrote to memory of 3028	1708	46842dada4cb041de43bee6d2cec7fd6.exe	28
PID 1708 wrote to memory of 3028	1708	46842dada4cb041de43bee6d2cec7fd6.exe	28

C:\Users\Admin\AppData\Local\Temp\46842dada4cb041de43bee6d2cec7fd6.exe
"C:\Users\Admin\AppData\Local\Temp\46842dada4cb041de43bee6d2cec7fd6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 88
  2⤵
  - Program crash
  PID:3028

memory/1708-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download