c49444edc643a67b6ed4391d854a3905781fc379c75d43017b0c161302401c22

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 21:31

Target

54a1d3f400ee7e2db182e486c4fede99.exe
Size

118KB
MD5

54a1d3f400ee7e2db182e486c4fede99
SHA1

96d5df237f0ed692215cf1f37272e8c5c3c31887
SHA256

c49444edc643a67b6ed4391d854a3905781fc379c75d43017b0c161302401c22
SHA512

aa76d4e1b2e126d6a0be42c9d2860858c040b5572df9e05d89b09913c15c4f7571b72433a5644e8a446424dd49d812d54419e66b66f900fe18f609f65a21f6f0
SSDEEP

1536:E3DPgE8sIykTqK5HYs7NJPUlFjjBUqW9LQjDLDV78dB7vJcqd2wpHsBQGnFW8pvu:C8aU4s7N5qbznPV7837xcqTSEK7cB+K

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
1832	2072	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1832	2072	54a1d3f400ee7e2db182e486c4fede99.exe	14
PID 2072 wrote to memory of 1832	2072	54a1d3f400ee7e2db182e486c4fede99.exe	14
PID 2072 wrote to memory of 1832	2072	54a1d3f400ee7e2db182e486c4fede99.exe	14
PID 2072 wrote to memory of 1832	2072	54a1d3f400ee7e2db182e486c4fede99.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 36
1⤵
- Program crash
PID:1832

C:\Users\Admin\AppData\Local\Temp\54a1d3f400ee7e2db182e486c4fede99.exe
"C:\Users\Admin\AppData\Local\Temp\54a1d3f400ee7e2db182e486c4fede99.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072

memory/2072-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download