ae970c22b0584183a852bb3a6fcfc467c357a2f7cec742a4176c7137912bba1a

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 18:22

Target

4c23c728383ea465f4f7d5e11c60763f.exe
Size

118KB
MD5

4c23c728383ea465f4f7d5e11c60763f
SHA1

6c3ee6b1b6f0d075acbd27c933a7bd64785547f5
SHA256

ae970c22b0584183a852bb3a6fcfc467c357a2f7cec742a4176c7137912bba1a
SHA512

0cd6ad6ab28f1acf7ae5d70dda304d0d3c98563c61dc8afae0addd0664745e93f0e2ead3218831b723f10d76e47a07f73a7ae34bf8903dfdd81457e81a2c6d07
SSDEEP

3072:m6xto8MshO0gRfT06nZ6abcpafGo3LU1XbVwfJvFPnUBJhLhO:ng8MN00fnZ3bcAfB3A1X+f1FPUBTU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1796	1368	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1796	1368	4c23c728383ea465f4f7d5e11c60763f.exe	28
PID 1368 wrote to memory of 1796	1368	4c23c728383ea465f4f7d5e11c60763f.exe	28
PID 1368 wrote to memory of 1796	1368	4c23c728383ea465f4f7d5e11c60763f.exe	28
PID 1368 wrote to memory of 1796	1368	4c23c728383ea465f4f7d5e11c60763f.exe	28

C:\Users\Admin\AppData\Local\Temp\4c23c728383ea465f4f7d5e11c60763f.exe
"C:\Users\Admin\AppData\Local\Temp\4c23c728383ea465f4f7d5e11c60763f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 36
  2⤵
  - Program crash
  PID:1796

memory/1368-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1368-1-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download