ccfa9153ae76af2b769de5742d0c112978b42b9d4f434f12cf63be9cd2944b5b

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 00:24

Target

4a2c719b9e51892af52f4400d2cc9a6c.exe
Size

111KB
MD5

4a2c719b9e51892af52f4400d2cc9a6c
SHA1

482f3f1ed67babf033e3eb81d5a146e8b638c742
SHA256

ccfa9153ae76af2b769de5742d0c112978b42b9d4f434f12cf63be9cd2944b5b
SHA512

6172b7605f7bf9da79bb78d69b6f47313ebab80d90e9312f7f314cc6165889da5504c5a8f79c7714b9af60ddf97232c845766cea45b7f2f51fe98a10e5e418e6
SSDEEP

1536:/Y3lOIc7J6mp2JzNUfUQ+3/6C4Vxex6nWe8zW3dBgJ2mo:/GOdcmpi2fEPKh8a3v82t

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3024	2932	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 3024	2932	4a2c719b9e51892af52f4400d2cc9a6c.exe	16
PID 2932 wrote to memory of 3024	2932	4a2c719b9e51892af52f4400d2cc9a6c.exe	16
PID 2932 wrote to memory of 3024	2932	4a2c719b9e51892af52f4400d2cc9a6c.exe	16
PID 2932 wrote to memory of 3024	2932	4a2c719b9e51892af52f4400d2cc9a6c.exe	16

C:\Users\Admin\AppData\Local\Temp\4a2c719b9e51892af52f4400d2cc9a6c.exe
"C:\Users\Admin\AppData\Local\Temp\4a2c719b9e51892af52f4400d2cc9a6c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 116
  2⤵
  - Program crash
  PID:3024

memory/2932-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download