8efce54c7469ffef9060e6fb4bd2f7fb902307485afcfc6032e1880e45ad4292

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09-01-2024 12:27

Target

4e4d7fe6ba2a61142f605d43137f0d86.exe
Size

124KB
MD5

4e4d7fe6ba2a61142f605d43137f0d86
SHA1

a451841c78e9ffcffbd67df31fa32437ca6428e8
SHA256

8efce54c7469ffef9060e6fb4bd2f7fb902307485afcfc6032e1880e45ad4292
SHA512

d3006d4298fad801e756f4a467a70a5ce95669c3c0e5e1fa80118a3d39b69157f37ec229152307e45823d0529ecc07edb21a747aaf0979c6eb8a8d366d3838ea
SSDEEP

3072:yzRIPcl/8DD+Z6Ix3o+CaeGp8OOKvs+qNm0HLm09S6mcl5:u558DD+ZPx37CNGaeID9S1cf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2200	1228	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 2200	1228	4e4d7fe6ba2a61142f605d43137f0d86.exe	28
PID 1228 wrote to memory of 2200	1228	4e4d7fe6ba2a61142f605d43137f0d86.exe	28
PID 1228 wrote to memory of 2200	1228	4e4d7fe6ba2a61142f605d43137f0d86.exe	28
PID 1228 wrote to memory of 2200	1228	4e4d7fe6ba2a61142f605d43137f0d86.exe	28

C:\Users\Admin\AppData\Local\Temp\4e4d7fe6ba2a61142f605d43137f0d86.exe
"C:\Users\Admin\AppData\Local\Temp\4e4d7fe6ba2a61142f605d43137f0d86.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 36
  2⤵
  - Program crash
  PID:2200

memory/1228-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1228-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download