8d4e12c543cfedb7a282217f3a8a0b02daca91b6fff2c520fe432d8b15e55e70

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 06:56

Target

48511c9002b10822769c319638db6d4e.exe
Size

21KB
MD5

48511c9002b10822769c319638db6d4e
SHA1

0f6df303307ab9c83f12794817b75806f5072100
SHA256

8d4e12c543cfedb7a282217f3a8a0b02daca91b6fff2c520fe432d8b15e55e70
SHA512

0f75af60d9d637b2246e43ba45541fadcc0c780753f13c55c8fd9597a1f4394d892d7f2c4028869b204a68fc77ed295d59651a2e57ea12b18427863843fd17b8
SSDEEP

384:k2S3RFjfXOftLkABlImNAUtIYyBmwCTjfVhGCK2R7H7t5TNI5+rhrY5:arftolIm4GwCTjfVB7/W5OY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2756	2156	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2756	2156	48511c9002b10822769c319638db6d4e.exe	16
PID 2156 wrote to memory of 2756	2156	48511c9002b10822769c319638db6d4e.exe	16
PID 2156 wrote to memory of 2756	2156	48511c9002b10822769c319638db6d4e.exe	16
PID 2156 wrote to memory of 2756	2156	48511c9002b10822769c319638db6d4e.exe	16

C:\Users\Admin\AppData\Local\Temp\48511c9002b10822769c319638db6d4e.exe
"C:\Users\Admin\AppData\Local\Temp\48511c9002b10822769c319638db6d4e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 36
  2⤵
  - Program crash
  PID:2756

memory/2156-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download