54b8bf481f0897d4d92f50bd5acc1a1f9dfe55a9014421b86663db86d575ef08

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 02:16

Target

4f50330982c15e843426b0206bd61e55.exe
Size

66KB
MD5

4f50330982c15e843426b0206bd61e55
SHA1

f80777fa8145f9ac691b888851a42c28730dd4fb
SHA256

54b8bf481f0897d4d92f50bd5acc1a1f9dfe55a9014421b86663db86d575ef08
SHA512

1249a1dc3ac6c3289e8d6215cedb397ce0f9f1f735ec66dc60edc8ca5ee602f0aa84314463b5728dab135f236abee3ca0d5024dd7c1e3a0c893e553fd574cfd8
SSDEEP

1536:HxZgSzNdECAspUFDXTKN26tY6w1t2UxR7LR6zMOqJxxVfBd:qCJCDKXfw1oU3RyG1fL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2136	2720	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2136	2720	4f50330982c15e843426b0206bd61e55.exe	28
PID 2720 wrote to memory of 2136	2720	4f50330982c15e843426b0206bd61e55.exe	28
PID 2720 wrote to memory of 2136	2720	4f50330982c15e843426b0206bd61e55.exe	28
PID 2720 wrote to memory of 2136	2720	4f50330982c15e843426b0206bd61e55.exe	28

C:\Users\Admin\AppData\Local\Temp\4f50330982c15e843426b0206bd61e55.exe
"C:\Users\Admin\AppData\Local\Temp\4f50330982c15e843426b0206bd61e55.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 36
  2⤵
  - Program crash
  PID:2136

memory/2720-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download