3e23c4a8083651cc4ccdab917272c4b3f3c5fa70acb89e1123a4723c34637156

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17-01-2024 18:33

Target

634e1caf2247addb6bd12dda52dbd4de.exe
Size

58KB
MD5

634e1caf2247addb6bd12dda52dbd4de
SHA1

c8237af522b7ff52f5febd54d66a63e193c50aa4
SHA256

3e23c4a8083651cc4ccdab917272c4b3f3c5fa70acb89e1123a4723c34637156
SHA512

dc7ecc5e651266263c67fb14e85417364037aaa7a8067583ba5471ab8b98adafacbb3b3afe977637963eb4dbf7aaf655c48eea15c57a8162e870f7f5a3f68f84
SSDEEP

1536:SFZG2U20yxmLNIF4vUa3PnPVGdEMNLE+JyddKi+tNeRYlHttkpcyK+4QsKgVUlbB:8HCjeiVvmWgeZfzIgN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2872	3004	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2872	3004	634e1caf2247addb6bd12dda52dbd4de.exe	16
PID 3004 wrote to memory of 2872	3004	634e1caf2247addb6bd12dda52dbd4de.exe	16
PID 3004 wrote to memory of 2872	3004	634e1caf2247addb6bd12dda52dbd4de.exe	16
PID 3004 wrote to memory of 2872	3004	634e1caf2247addb6bd12dda52dbd4de.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 36
1⤵
- Program crash
PID:2872

C:\Users\Admin\AppData\Local\Temp\634e1caf2247addb6bd12dda52dbd4de.exe
"C:\Users\Admin\AppData\Local\Temp\634e1caf2247addb6bd12dda52dbd4de.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3004

memory/3004-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3004-1-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download