c25aeee475940e757d26aaa96c161d427737e4e06abfab3ce415ae7a864b199d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 21:50

Target

4c8a613d445f1a1a6545ed023aa5e2c4.exe
Size

18KB
MD5

4c8a613d445f1a1a6545ed023aa5e2c4
SHA1

e4007e1e7b9ae91bea561215106c90c7f0235002
SHA256

c25aeee475940e757d26aaa96c161d427737e4e06abfab3ce415ae7a864b199d
SHA512

b0b462a80cd853cfbc5304bd78199e7eef89325ead95ceaf7b51210bc277677b443d931fc9b97010738fd37414042ffaf510454bf9f17a1132c9a212d8484b89
SSDEEP

384:ZBskec5qDm4bd0IXRiMujCnNMvvJIVg9tepzeCPKz9fXNJn:okPypbuIXRIkwJI67epCrJn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2948	2932	WerFault.exe	11

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2948	2932	4c8a613d445f1a1a6545ed023aa5e2c4.exe	28
PID 2932 wrote to memory of 2948	2932	4c8a613d445f1a1a6545ed023aa5e2c4.exe	28
PID 2932 wrote to memory of 2948	2932	4c8a613d445f1a1a6545ed023aa5e2c4.exe	28
PID 2932 wrote to memory of 2948	2932	4c8a613d445f1a1a6545ed023aa5e2c4.exe	28

C:\Users\Admin\AppData\Local\Temp\4c8a613d445f1a1a6545ed023aa5e2c4.exe
"C:\Users\Admin\AppData\Local\Temp\4c8a613d445f1a1a6545ed023aa5e2c4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 36
  2⤵
  - Program crash
  PID:2948