4c9c817bfa4be0659cf46e98365a663be3113ac0640dcee052f9007eac80f576

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 12:39

Target

538a703af21dd3dec2b10b3559cbe2dd.exe
Size

367KB
MD5

538a703af21dd3dec2b10b3559cbe2dd
SHA1

e3d4cdcd1b5887525fe5b40194d57ec2f0a59813
SHA256

4c9c817bfa4be0659cf46e98365a663be3113ac0640dcee052f9007eac80f576
SHA512

70ee83667059f7c45a49af2c16077071e61fc575c832755d46c30c6e469bb9a79fdca1ada0c8895fb0124e96e1f2daaa644d90bd65d059905e01c8b7f6350f25
SSDEEP

6144:rpEcAd/Mm5ZkyUneRTnJOmQ4W4/6zA5K0TzJRCp4xRvKUllD/W13+r:rTAOm5eyUnJmCzAXTzJR3RvK6lCwr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3000	2548	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 3000	2548	538a703af21dd3dec2b10b3559cbe2dd.exe	28
PID 2548 wrote to memory of 3000	2548	538a703af21dd3dec2b10b3559cbe2dd.exe	28
PID 2548 wrote to memory of 3000	2548	538a703af21dd3dec2b10b3559cbe2dd.exe	28
PID 2548 wrote to memory of 3000	2548	538a703af21dd3dec2b10b3559cbe2dd.exe	28

C:\Users\Admin\AppData\Local\Temp\538a703af21dd3dec2b10b3559cbe2dd.exe
"C:\Users\Admin\AppData\Local\Temp\538a703af21dd3dec2b10b3559cbe2dd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 116
  2⤵
  - Program crash
  PID:3000

memory/2548-0-0x00000000008F0000-0x0000000000950000-memory.dmp

Filesize
384KB

Download