576c1ba3fb0a97d348ad8971e29c136843d32d9d3d9cee134a9a91957523fb1e

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-01-2024 14:16

Target

67d4782f0034ad2561a500b0a5587994.exe
Size

74KB
MD5

67d4782f0034ad2561a500b0a5587994
SHA1

9d2cb657d6bd22122fffafbcef441eac5e8c630a
SHA256

576c1ba3fb0a97d348ad8971e29c136843d32d9d3d9cee134a9a91957523fb1e
SHA512

9509be51e03ffdd012a67b81cafea8c5ec439be364a842e6f13c6ee303ec79992f3ce1190346478dce87de34c7206056e5b5c3c108c190617e297ef18a221fc6
SSDEEP

1536:GDzZ+B+/uznXABUJf6L7QSX0dw45P9jkfsu3uS9aqFd+EceNLIBuqMzkhp:GDq0usBUJygSE1YB3uS9aa+Ev8th

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2812	2044	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2812	2044	67d4782f0034ad2561a500b0a5587994.exe	28
PID 2044 wrote to memory of 2812	2044	67d4782f0034ad2561a500b0a5587994.exe	28
PID 2044 wrote to memory of 2812	2044	67d4782f0034ad2561a500b0a5587994.exe	28
PID 2044 wrote to memory of 2812	2044	67d4782f0034ad2561a500b0a5587994.exe	28

C:\Users\Admin\AppData\Local\Temp\67d4782f0034ad2561a500b0a5587994.exe
"C:\Users\Admin\AppData\Local\Temp\67d4782f0034ad2561a500b0a5587994.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 128
  2⤵
  - Program crash
  PID:2812

memory/2044-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2044-1-0x0000000000020000-0x0000000000031000-memory.dmp

Filesize
68KB

Download
memory/2044-2-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2044-4-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/2044-5-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download