7110e7ba940275b548a0db57dcb4bf7dd0656b5532c3a25358a6b8cec0e38984

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 02:52

Target

4a42372cd8a8962e569cdedd084891db.exe
Size

560KB
MD5

4a42372cd8a8962e569cdedd084891db
SHA1

0a48a4498111485121f19f4fe3fb804fb2f8bc97
SHA256

7110e7ba940275b548a0db57dcb4bf7dd0656b5532c3a25358a6b8cec0e38984
SHA512

e716b1c61e084571d1ae60ffebfa9159c1f2927123cffb6ef87af47e5dfd8b81463f46186f0cf584e438704d55586f80ddafec83096281d6d7e19aafc4ef2d64
SSDEEP

6144:TkU+PqJdRGW6h3WCqQgVOq4rbgZBcA1LiC1kStX344DWV/b5eY:YUtRA3WCCVr14SVF0MY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	2212	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 1992	2212	4a42372cd8a8962e569cdedd084891db.exe	28
PID 2212 wrote to memory of 1992	2212	4a42372cd8a8962e569cdedd084891db.exe	28
PID 2212 wrote to memory of 1992	2212	4a42372cd8a8962e569cdedd084891db.exe	28
PID 2212 wrote to memory of 1992	2212	4a42372cd8a8962e569cdedd084891db.exe	28

C:\Users\Admin\AppData\Local\Temp\4a42372cd8a8962e569cdedd084891db.exe
"C:\Users\Admin\AppData\Local\Temp\4a42372cd8a8962e569cdedd084891db.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 36
  2⤵
  - Program crash
  PID:1992

memory/2212-0-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download