dfa54189cac138e3f4c8102af75840e81bc659892659900bd2bbee4175db40a4

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07-01-2024 00:43

Target

479698a8844fb1f63caf5bc8a7fb1d53.exe
Size

345KB
MD5

479698a8844fb1f63caf5bc8a7fb1d53
SHA1

eafda2fa96096b23df3d356c55ac98e832ff41a4
SHA256

dfa54189cac138e3f4c8102af75840e81bc659892659900bd2bbee4175db40a4
SHA512

c1a592cf7dd7ad08ff34d814e4a3a93c8a669cc5a470e735f6a03648f4a9e426d7fbf1d52f8b6468af3b9ce792b239f278dd17fb6acd03b54730c6c038895c80
SSDEEP

6144:tkSEQBx+VLuenAptE41rZe3/nlRcXgXLzRUr21CXSLrzL9gPKZD0eSZDyn:tkSEQWL5Apdw3/l+QXLzRyuzL97SZ2n

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2180	1976	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2180	1976	479698a8844fb1f63caf5bc8a7fb1d53.exe	16
PID 1976 wrote to memory of 2180	1976	479698a8844fb1f63caf5bc8a7fb1d53.exe	16
PID 1976 wrote to memory of 2180	1976	479698a8844fb1f63caf5bc8a7fb1d53.exe	16
PID 1976 wrote to memory of 2180	1976	479698a8844fb1f63caf5bc8a7fb1d53.exe	16

C:\Users\Admin\AppData\Local\Temp\479698a8844fb1f63caf5bc8a7fb1d53.exe
"C:\Users\Admin\AppData\Local\Temp\479698a8844fb1f63caf5bc8a7fb1d53.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 88
  2⤵
  - Program crash
  PID:2180

memory/1976-0-0x0000000000400000-0x00000000004CB01E-memory.dmp

Filesize
812KB

Download