e1e4ecd94004911ba8e88661ae184be57964555d3e190d4680a22987d0aa61a5

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 06:44

Target

484b7586f8b12783849d4d46b95003e7.exe
Size

23KB
MD5

484b7586f8b12783849d4d46b95003e7
SHA1

85ab0af7b2afa07016dcfe9725a044180070b8b4
SHA256

e1e4ecd94004911ba8e88661ae184be57964555d3e190d4680a22987d0aa61a5
SHA512

066335071c8f5de936d7cfc3011ba1c3f81893f045c783775e2d1f95cd057887bbcab76c2558151ac702f4ee30c74e019abdb3ce1129bc006c87310ef179a105
SSDEEP

384:j1mV1IHfQxShwZ0zhBQ56vwhvs/Lu+BNkGqcuBl5LPgTkBTH6JxE6ntb+esn01:j1mV1IHfAFZ0dNuKNkGqNGoH6XnN+e40

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2728	2628	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2728	2628	484b7586f8b12783849d4d46b95003e7.exe	28
PID 2628 wrote to memory of 2728	2628	484b7586f8b12783849d4d46b95003e7.exe	28
PID 2628 wrote to memory of 2728	2628	484b7586f8b12783849d4d46b95003e7.exe	28
PID 2628 wrote to memory of 2728	2628	484b7586f8b12783849d4d46b95003e7.exe	28

C:\Users\Admin\AppData\Local\Temp\484b7586f8b12783849d4d46b95003e7.exe
"C:\Users\Admin\AppData\Local\Temp\484b7586f8b12783849d4d46b95003e7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 88
  2⤵
  - Program crash
  PID:2728

memory/2628-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2628-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download