10818e7e85f175b664a0174650e3f43c0f298d5c6e94664046245969f3378864

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 06:17

Target

4d9124dba64724600b4e745533dcb6f3.exe
Size

23KB
MD5

4d9124dba64724600b4e745533dcb6f3
SHA1

e79e1479f55db3fe689132887e16f93ad702a8a9
SHA256

10818e7e85f175b664a0174650e3f43c0f298d5c6e94664046245969f3378864
SHA512

ab4597888df1deea1730918ae247ff2ed90f71f4e7e94740b416beee7e0d0bf6bde7679065333c8b38a2c5f9044ae8fcaab9cab50fa874cc93fe9e80ed89f349
SSDEEP

192:Vq9G6DCNbk3fU81Mk+m7phNo+o1Ms21aErvfBGVeINh3qfDPRRRRRRRRRRRRRRRG:VqPClcUm+k3U21NrQeqOiwYjt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2996	2912	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2996	2912	4d9124dba64724600b4e745533dcb6f3.exe	28
PID 2912 wrote to memory of 2996	2912	4d9124dba64724600b4e745533dcb6f3.exe	28
PID 2912 wrote to memory of 2996	2912	4d9124dba64724600b4e745533dcb6f3.exe	28
PID 2912 wrote to memory of 2996	2912	4d9124dba64724600b4e745533dcb6f3.exe	28

C:\Users\Admin\AppData\Local\Temp\4d9124dba64724600b4e745533dcb6f3.exe
"C:\Users\Admin\AppData\Local\Temp\4d9124dba64724600b4e745533dcb6f3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 92
  2⤵
  - Program crash
  PID:2996