c3a9984b023df32ec38cfdd939d50f1fccf680fe2d748a0ec0ef2802a6ea8613

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 20:16

Target

4716ade4eb2b3a0adf81fd7ffe8ec80a.exe
Size

78KB
MD5

4716ade4eb2b3a0adf81fd7ffe8ec80a
SHA1

defe16b381d4c2be9fcd894b0c4441cca29c3cc2
SHA256

c3a9984b023df32ec38cfdd939d50f1fccf680fe2d748a0ec0ef2802a6ea8613
SHA512

a351dca13044a31b5ea49c627f1c84e6ff520b62e9576803d0f1d004a3276d58e963a0b7605af7362035a3825feab1dfd03dcfcb4fc6b6ae45c02067b07bd79b
SSDEEP

1536:ZgEQtcpPyOUhU/CSRZE3h4YB7vGEUKZuXRpFLxyuCE00lE0T:OEQtoyOcKZEfB6/KZuXNV0i5T

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
1780	2180	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1780	2180	4716ade4eb2b3a0adf81fd7ffe8ec80a.exe	14
PID 2180 wrote to memory of 1780	2180	4716ade4eb2b3a0adf81fd7ffe8ec80a.exe	14
PID 2180 wrote to memory of 1780	2180	4716ade4eb2b3a0adf81fd7ffe8ec80a.exe	14
PID 2180 wrote to memory of 1780	2180	4716ade4eb2b3a0adf81fd7ffe8ec80a.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 88
1⤵
- Program crash
PID:1780

C:\Users\Admin\AppData\Local\Temp\4716ade4eb2b3a0adf81fd7ffe8ec80a.exe
"C:\Users\Admin\AppData\Local\Temp\4716ade4eb2b3a0adf81fd7ffe8ec80a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180