e4e2a43cdd6d904076b7d21a99815b89175baf3aacd62fcb35d8fad6f2369dcd

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 23:25

Target

4a0c382464009d3922dff1920bfa0d15.exe
Size

32KB
MD5

4a0c382464009d3922dff1920bfa0d15
SHA1

3fcb6e264d2f977dd6d44623a0bd054a46cd7780
SHA256

e4e2a43cdd6d904076b7d21a99815b89175baf3aacd62fcb35d8fad6f2369dcd
SHA512

e2c4200bec37c416d8662199ae5d466a2a71c623914270d5ca4b1b10b001b4d0725b0c12e3525ea04aecfd80cc9313916ead31d3cd26ede59a7cd7a83c5d376b
SSDEEP

768:dKXHFfGej0lAciWlnYPifxADLbSFB5xuXpuR4SpTy4:dK1ue4lAciXQoO35xJeOT5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1636	3060	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 1636	3060	4a0c382464009d3922dff1920bfa0d15.exe	28
PID 3060 wrote to memory of 1636	3060	4a0c382464009d3922dff1920bfa0d15.exe	28
PID 3060 wrote to memory of 1636	3060	4a0c382464009d3922dff1920bfa0d15.exe	28
PID 3060 wrote to memory of 1636	3060	4a0c382464009d3922dff1920bfa0d15.exe	28

C:\Users\Admin\AppData\Local\Temp\4a0c382464009d3922dff1920bfa0d15.exe
"C:\Users\Admin\AppData\Local\Temp\4a0c382464009d3922dff1920bfa0d15.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 36
  2⤵
  - Program crash
  PID:1636

memory/3060-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download