3cc84ec32ea63db0a194f4de4f98f71bde5bf5b573f6737369de1aac41ee0fcc

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 13:35

Target

491dd4304716e609fc50d51b8bfabf58.exe
Size

367KB
MD5

491dd4304716e609fc50d51b8bfabf58
SHA1

21c90c2119c8c698ed4d4d4c69379f8f4e8b9543
SHA256

3cc84ec32ea63db0a194f4de4f98f71bde5bf5b573f6737369de1aac41ee0fcc
SHA512

ee646a0c0fe19374e33cd08510e268d2058ae5ea5682a0134568ae736aed7931c5a86f006f335f785e5a78428a6fb1eb882b0c6984a3269757062ab958e0142f
SSDEEP

6144:rpEcAd/Mm5ZkyUneRTnJOmQ4W4/6zA5K0TzJRCp4xRvKUllD/W13+5:rTAOm5eyUnJmCzAXTzJR3RvK6lCw5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2044	3048	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2044	3048	491dd4304716e609fc50d51b8bfabf58.exe	16
PID 3048 wrote to memory of 2044	3048	491dd4304716e609fc50d51b8bfabf58.exe	16
PID 3048 wrote to memory of 2044	3048	491dd4304716e609fc50d51b8bfabf58.exe	16
PID 3048 wrote to memory of 2044	3048	491dd4304716e609fc50d51b8bfabf58.exe	16

C:\Users\Admin\AppData\Local\Temp\491dd4304716e609fc50d51b8bfabf58.exe
"C:\Users\Admin\AppData\Local\Temp\491dd4304716e609fc50d51b8bfabf58.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 116
  2⤵
  - Program crash
  PID:2044

memory/3048-0-0x0000000001220000-0x0000000001280000-memory.dmp

Filesize
384KB

Download