45d14c5aae38ea1512f53d172e50e09d9384e8c23577c81d597ad6fa2fdb6c18

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-01-2024 17:40

Target

72a41eaded2762abae68d3b2c51ca646.exe
Size

167KB
MD5

72a41eaded2762abae68d3b2c51ca646
SHA1

1c245321efe18f070daf4c6c0be39c93045a528a
SHA256

45d14c5aae38ea1512f53d172e50e09d9384e8c23577c81d597ad6fa2fdb6c18
SHA512

9eea6aacc8d14a890d6bbab98ac3e88842f5db688f97fd39287e252e7b888b303cd97cbe436b5a6c9d89c51471834c63190e2f17edd99f5061ddb8b7eb155e66
SSDEEP

3072:ozycQ4i4R0lZC701yh0VJMcFJXugwIauEaAe7TIqs0/hNV86auv:jpRnC70zzXRwIkcIqsKu6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2340	2180	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2340	2180	72a41eaded2762abae68d3b2c51ca646.exe	17
PID 2180 wrote to memory of 2340	2180	72a41eaded2762abae68d3b2c51ca646.exe	17
PID 2180 wrote to memory of 2340	2180	72a41eaded2762abae68d3b2c51ca646.exe	17
PID 2180 wrote to memory of 2340	2180	72a41eaded2762abae68d3b2c51ca646.exe	17

C:\Users\Admin\AppData\Local\Temp\72a41eaded2762abae68d3b2c51ca646.exe
"C:\Users\Admin\AppData\Local\Temp\72a41eaded2762abae68d3b2c51ca646.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 196
  2⤵
  - Program crash
  PID:2340