40fdf6d22b75cf692de063745ef75a97b4e6de163de1582c35a3cc5cf6eeaf82

Analysis

max time kernel
143s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 03:47

Target
4a5bd59f43e9cd8fdce0ba89c1006e15.exe
Size 665KB
Sample240108-ecjc7aaefp
SHA256 40fdf6d22b75cf692de063745ef75a97b4e6de163de1582c35a3cc5cf6eeaf82
MD5 4a5bd59f43e9cd8fdce0ba89c1006e15
SHA1 a50147b0916f889f57b53af1da9a6e2f88d4420b
SHA512 79537225a429b3c446c5a575c74f1f75ab2f6efae5eb0f0152a1b564fb95e9f535ea9a03a3603489c0580bb35001a9e0ae921c08b3cbc83de57fc068f9d66806
SSDEEP 12288:c+JW55odXSD5s7ztjhUFEpq8pENLDJhXGLXcs5CpV9GEacVK5JRPej:PsfyGK75jhUOvKLV5M0pnXVK7RP
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2940	2220	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2940	2220	4a5bd59f43e9cd8fdce0ba89c1006e15.exe	28
PID 2220 wrote to memory of 2940	2220	4a5bd59f43e9cd8fdce0ba89c1006e15.exe	28
PID 2220 wrote to memory of 2940	2220	4a5bd59f43e9cd8fdce0ba89c1006e15.exe	28
PID 2220 wrote to memory of 2940	2220	4a5bd59f43e9cd8fdce0ba89c1006e15.exe	28

C:\Users\Admin\AppData\Local\Temp\4a5bd59f43e9cd8fdce0ba89c1006e15.exe
"C:\Users\Admin\AppData\Local\Temp\4a5bd59f43e9cd8fdce0ba89c1006e15.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 160
  2⤵
  - Program crash
  PID:2940

memory/2220-0-0x0000000000020000-0x0000000000028000-memory.dmp

Download

memory/2220-1-0x0000000000400000-0x0000000000609000-memory.dmp

Download