bf3a28073b61b10a1eedf1c682dc7f3ce16449e63d800182978e0a2cf9c261b1

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 13:52

Target

4e79a2c539481625ee244437e82ea981.exe
Size

15KB
MD5

4e79a2c539481625ee244437e82ea981
SHA1

18db5828a9eba692f260f9e5b47ad9e9585db15a
SHA256

bf3a28073b61b10a1eedf1c682dc7f3ce16449e63d800182978e0a2cf9c261b1
SHA512

2c7d4373851e64ef3c1d7d99308a5b8a7fc89e71641379757d42c28ea1d19db5ee5f05c9fdba3d96fa55415a8078e1e99e2b83ab3d62e68401ea6561c9694b35
SSDEEP

192:u9WwmWausOxBbnWQJjwF1im7z5NGOuWLvWn9sZSe+6z94Y0tDdw57UrLStjv7rH:kWwmWJVbdjwFPzzGOu4m9s+66w5rJDrH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
1872	1460	WerFault.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1872	1460	4e79a2c539481625ee244437e82ea981.exe	15
PID 1460 wrote to memory of 1872	1460	4e79a2c539481625ee244437e82ea981.exe	15
PID 1460 wrote to memory of 1872	1460	4e79a2c539481625ee244437e82ea981.exe	15
PID 1460 wrote to memory of 1872	1460	4e79a2c539481625ee244437e82ea981.exe	15
PID 1460 wrote to memory of 1872	1460	4e79a2c539481625ee244437e82ea981.exe	15
PID 1460 wrote to memory of 1872	1460	4e79a2c539481625ee244437e82ea981.exe	15
PID 1460 wrote to memory of 1872	1460	4e79a2c539481625ee244437e82ea981.exe	15

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 252
1⤵
- Program crash
PID:1872

C:\Users\Admin\AppData\Local\Temp\4e79a2c539481625ee244437e82ea981.exe
"C:\Users\Admin\AppData\Local\Temp\4e79a2c539481625ee244437e82ea981.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1460

memory/1460-1-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/1460-5-0x0000000013140000-0x0000000013150000-memory.dmp

Filesize
64KB

Download
memory/1460-4-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/1460-3-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1460-2-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/1460-0-0x0000000013140000-0x0000000013150000-memory.dmp

Filesize
64KB

Download
memory/1460-6-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/1460-7-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/1460-8-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1460-9-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download