250225b66272479828497568f46d66ff74448fe5785787b2ab8fda2b58b60e70

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 22:03

Target

49e3012295bb3f954efe406986934aca.exe
Size

514KB
MD5

49e3012295bb3f954efe406986934aca
SHA1

a737128fc435563cace56ef87b5972dbf7404ca9
SHA256

250225b66272479828497568f46d66ff74448fe5785787b2ab8fda2b58b60e70
SHA512

a73108032b5032e89ff8a82a8c6077ba312945bddfb3272aa1d3c945a39edce271b239b446d23694882cb52877ccb5c5dae42100b52c524486b83f73afb7898d
SSDEEP

6144:rpOSC8RaS/NyiJRycxoEB02oWYsLxlH1CMX/D751LmZXds54p2G+KeIs3fo8vKq7:3CSD/ycxPBAuxlVtD751ep5iVSK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2260	1932	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2260	1932	49e3012295bb3f954efe406986934aca.exe	28
PID 1932 wrote to memory of 2260	1932	49e3012295bb3f954efe406986934aca.exe	28
PID 1932 wrote to memory of 2260	1932	49e3012295bb3f954efe406986934aca.exe	28
PID 1932 wrote to memory of 2260	1932	49e3012295bb3f954efe406986934aca.exe	28

C:\Users\Admin\AppData\Local\Temp\49e3012295bb3f954efe406986934aca.exe
"C:\Users\Admin\AppData\Local\Temp\49e3012295bb3f954efe406986934aca.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 196
  2⤵
  - Program crash
  PID:2260

memory/1932-0-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1932-1-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1932-2-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download