728250fd7a31f536b7f1a6e153194ef24af99a511ea9720760720f56cb5d849e

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 09:18

Target

4b0badfc100e7de3a4d93a5c31292887.exe
Size

18KB
MD5

4b0badfc100e7de3a4d93a5c31292887
SHA1

d5baf68a2540ccc526c3718b185d9e79224bdd98
SHA256

728250fd7a31f536b7f1a6e153194ef24af99a511ea9720760720f56cb5d849e
SHA512

b62fbcc7e474186d8229c8fb64a5db775a007f51a0ad60e1513739a6db11dee38fc9217fa8bb6fda8c4b4f29a1e0574acf0015415cd3e92080bc49a97a7224f4
SSDEEP

384:LdI6IYf3DxWzF6b8MYhAJVRxafaTgjH2lo0rJG0+Axqr6+I9PfYUD:RI6IYfzxa6oMYmRxaiT6WW0rJG0Jx1L9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2424	2380	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2424	2380	4b0badfc100e7de3a4d93a5c31292887.exe	16
PID 2380 wrote to memory of 2424	2380	4b0badfc100e7de3a4d93a5c31292887.exe	16
PID 2380 wrote to memory of 2424	2380	4b0badfc100e7de3a4d93a5c31292887.exe	16
PID 2380 wrote to memory of 2424	2380	4b0badfc100e7de3a4d93a5c31292887.exe	16

C:\Users\Admin\AppData\Local\Temp\4b0badfc100e7de3a4d93a5c31292887.exe
"C:\Users\Admin\AppData\Local\Temp\4b0badfc100e7de3a4d93a5c31292887.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 36
  2⤵
  - Program crash
  PID:2424

memory/2380-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2380-1-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download