1187e9a2266e72c836d5cb2ce8c9c7df23805db9ceda4930ed2d33834f6e5d1b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 10:42

Target

4e172c9df1e6158da131cfe77979ae89.exe
Size

160KB
MD5

4e172c9df1e6158da131cfe77979ae89
SHA1

7c4728e7b0f4597b7390ddc74967bf8da470e38d
SHA256

1187e9a2266e72c836d5cb2ce8c9c7df23805db9ceda4930ed2d33834f6e5d1b
SHA512

690c2bddc2cca3b014264d441e5c336b378531c033526df83d3f49b6bcdc906d47a1b4a0e9f5ac981140470a83367c97483cc2c3c7c3293fdd0d54410601768f
SSDEEP

3072:5O9MNyqpQyN404zahJF/Ff5xX88wnamShqsHJb:A2Nyl7zanF/FRxM8wnbkqspb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1704	824	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 1704	824	4e172c9df1e6158da131cfe77979ae89.exe	28
PID 824 wrote to memory of 1704	824	4e172c9df1e6158da131cfe77979ae89.exe	28
PID 824 wrote to memory of 1704	824	4e172c9df1e6158da131cfe77979ae89.exe	28
PID 824 wrote to memory of 1704	824	4e172c9df1e6158da131cfe77979ae89.exe	28

C:\Users\Admin\AppData\Local\Temp\4e172c9df1e6158da131cfe77979ae89.exe
"C:\Users\Admin\AppData\Local\Temp\4e172c9df1e6158da131cfe77979ae89.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 36
  2⤵
  - Program crash
  PID:1704

memory/824-0-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download