1f2315d5b4ad5583d36a093f756bab7e986d857868f5ff8e079c28b6fb82e7d7

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 05:30

Target

4fb588b2b01e3d343d0e5599abb98e00.exe
Size

21KB
MD5

4fb588b2b01e3d343d0e5599abb98e00
SHA1

63465f2d1301b1c3c6c30cb0308dddfac1da0cfd
SHA256

1f2315d5b4ad5583d36a093f756bab7e986d857868f5ff8e079c28b6fb82e7d7
SHA512

01ffe7e91e18d5e6a4df1b1fed9626beb9054a7135928e58e9d9faa7e8477732cbdab5c9f285f8c0239f3f5b1fc815ef24a646f51268bb5af536ce221638fba0
SSDEEP

384:wY4GVC+oogrfu4IN/WhIsb865w2IcAeymJzw3JQFMj994pk/JOOVoxNl6r:scC3r9IdWhP40wQAbmJc3KLlO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3068	3056	WerFault.exe	8

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 3068	3056	4fb588b2b01e3d343d0e5599abb98e00.exe	20
PID 3056 wrote to memory of 3068	3056	4fb588b2b01e3d343d0e5599abb98e00.exe	20
PID 3056 wrote to memory of 3068	3056	4fb588b2b01e3d343d0e5599abb98e00.exe	20
PID 3056 wrote to memory of 3068	3056	4fb588b2b01e3d343d0e5599abb98e00.exe	20

C:\Users\Admin\AppData\Local\Temp\4fb588b2b01e3d343d0e5599abb98e00.exe
"C:\Users\Admin\AppData\Local\Temp\4fb588b2b01e3d343d0e5599abb98e00.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 36
  2⤵
  - Program crash
  PID:3068

memory/3056-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download