42e6c47a7b804e784cc872413411d5b851906b4871914d07487d9b9a69ab06c9

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 13:30

Target

VirusShare_c841b29c7b37606c98f8a764ea7a3b5c.exe
Size

216KB
MD5

c841b29c7b37606c98f8a764ea7a3b5c
SHA1

2c3e0b312d8bda1f746ffd9decff5bf37c41f76f
SHA256

42e6c47a7b804e784cc872413411d5b851906b4871914d07487d9b9a69ab06c9
SHA512

3e5732635665d9288305be85182a577116bda30aa23492c17139c1d00e9d1bbe6d4940b51360b620da8205638625bf515cf28dd6015006699b4fa4616a70b7cd
SSDEEP

3072:FlCCGsYfNqu+f9/vIBkuUnJNMAMWO7Ze4GWGTnnY6V4WfwPuuwtiOC:/iquA/ubUnVMWOxGWGTnY6Omf9C

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1248	2536	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 1248	2536	VirusShare_c841b29c7b37606c98f8a764ea7a3b5c.exe	16
PID 2536 wrote to memory of 1248	2536	VirusShare_c841b29c7b37606c98f8a764ea7a3b5c.exe	16
PID 2536 wrote to memory of 1248	2536	VirusShare_c841b29c7b37606c98f8a764ea7a3b5c.exe	16
PID 2536 wrote to memory of 1248	2536	VirusShare_c841b29c7b37606c98f8a764ea7a3b5c.exe	16

C:\Users\Admin\AppData\Local\Temp\VirusShare_c841b29c7b37606c98f8a764ea7a3b5c.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_c841b29c7b37606c98f8a764ea7a3b5c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 92
  2⤵
  - Program crash
  PID:1248