43218e3ff20d24ec943438198d627ae33cd4d8642f20be00c3300e3307d61876

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09-01-2024 12:14

Target

4e46ffe30640ef0981aa00279390f534.exe
Size

319KB
MD5

4e46ffe30640ef0981aa00279390f534
SHA1

c56a5016720841950fa60534284325bfb70c7b4b
SHA256

43218e3ff20d24ec943438198d627ae33cd4d8642f20be00c3300e3307d61876
SHA512

d42ba859379d3a16019a69b8f74a37451def8312d31cc316c53f767878ac5db8f1300ce3450e7a677a13cbda513f70429170da6bb059bcc8649c488568a97fb2
SSDEEP

6144:Ch7UQHYaZlVrtv35CPXbo92ynn8sbeWD2/o85/LCSuS5CPXbod:a7UMLHRFbe7w8NL5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1276	2236	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1276	2236	4e46ffe30640ef0981aa00279390f534.exe	28
PID 2236 wrote to memory of 1276	2236	4e46ffe30640ef0981aa00279390f534.exe	28
PID 2236 wrote to memory of 1276	2236	4e46ffe30640ef0981aa00279390f534.exe	28
PID 2236 wrote to memory of 1276	2236	4e46ffe30640ef0981aa00279390f534.exe	28

C:\Users\Admin\AppData\Local\Temp\4e46ffe30640ef0981aa00279390f534.exe
"C:\Users\Admin\AppData\Local\Temp\4e46ffe30640ef0981aa00279390f534.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 140
  2⤵
  - Program crash
  PID:1276

memory/2236-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2236-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download