cfe2bfd441abcd81bcbd10695ff2f6e186d8f6304822d89c8d3e8cff2c435a2f

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 06:21

Target

73f4f136fe16c3748433ceb5d112183d.exe
Size

383KB
MD5

73f4f136fe16c3748433ceb5d112183d
SHA1

6272fe0d78d8d6e2ea9889063789c345cb3380b7
SHA256

cfe2bfd441abcd81bcbd10695ff2f6e186d8f6304822d89c8d3e8cff2c435a2f
SHA512

e2695ce9c2e8040abcfe0c3d7dac8ac59de882f2ccf3240b232216f34337aba5a4bda5fc7776b6bece831602984a271fc7ea979349ea403c7fa954701e831b87
SSDEEP

6144:NqtcVlQCStqeMRYsaCMb8j+wE8eNPdjMpPYGdjAPPs/7iTl94tZOUgamuMLp9Mbu:EtcVlRStqeMasapb8pSLWkc/SUWj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2864	1672	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2864	1672	73f4f136fe16c3748433ceb5d112183d.exe	28
PID 1672 wrote to memory of 2864	1672	73f4f136fe16c3748433ceb5d112183d.exe	28
PID 1672 wrote to memory of 2864	1672	73f4f136fe16c3748433ceb5d112183d.exe	28
PID 1672 wrote to memory of 2864	1672	73f4f136fe16c3748433ceb5d112183d.exe	28

C:\Users\Admin\AppData\Local\Temp\73f4f136fe16c3748433ceb5d112183d.exe
"C:\Users\Admin\AppData\Local\Temp\73f4f136fe16c3748433ceb5d112183d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 204
  2⤵
  - Program crash
  PID:2864