4290be69b60e687603a18d03a4cd36fc69add48a56f924b9068006e2afa4a32c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 23:37

Target

51ef5442418131b56ceea54ebefabaa6.exe
Size

321KB
MD5

51ef5442418131b56ceea54ebefabaa6
SHA1

461c23a3f0eba97d65f5e5e2385d148007fe60f1
SHA256

4290be69b60e687603a18d03a4cd36fc69add48a56f924b9068006e2afa4a32c
SHA512

a0d0ea38e7dbea5699f7dd1c6ec871719a1d83b1dac1041c52685a00f592279a850404bb0c7736d15db72aee20336d0860c29f035546eaf86e7fdfe5c5d7efc9
SSDEEP

6144:rNxa/EJddK7vwK1poH7td/tQqG56Prd3Z5NBA3r12Ii:rO/YddK7vw0oHprG5+3a7O

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
1572	1740	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1572	1740	51ef5442418131b56ceea54ebefabaa6.exe	14
PID 1740 wrote to memory of 1572	1740	51ef5442418131b56ceea54ebefabaa6.exe	14
PID 1740 wrote to memory of 1572	1740	51ef5442418131b56ceea54ebefabaa6.exe	14
PID 1740 wrote to memory of 1572	1740	51ef5442418131b56ceea54ebefabaa6.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 116
1⤵
- Program crash
PID:1572

C:\Users\Admin\AppData\Local\Temp\51ef5442418131b56ceea54ebefabaa6.exe
"C:\Users\Admin\AppData\Local\Temp\51ef5442418131b56ceea54ebefabaa6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1740

memory/1740-0-0x0000000001060000-0x00000000010B5000-memory.dmp

Filesize
340KB

Download