2b52ff31f1e3eeb17b8cc6fe5aa354fe787b97818f31fec5c60489636d62a54e

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 19:31

Target

a4e55b134fe1f35e2c86ddefc420c840.exe
Size

29KB
MD5

a4e55b134fe1f35e2c86ddefc420c840
SHA1

24f1c3f2bd6b6dc50eba24d1dec9465c135e6a63
SHA256

2b52ff31f1e3eeb17b8cc6fe5aa354fe787b97818f31fec5c60489636d62a54e
SHA512

eae7e548ebb816af1f319489b8cc6b2aefc7129c2c9eb214da65dc950d57af32d7496d3ccbe98ef9575ee55199b9b6fd000c071fa61d551dbe39a42b49597681
SSDEEP

768:plOpnqjUI/I7ss4TufgvF9YiOIz4dEFiRm:nO0s4Tufgvvlxz8ei

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1856	1936	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1856	1936	a4e55b134fe1f35e2c86ddefc420c840.exe	28
PID 1936 wrote to memory of 1856	1936	a4e55b134fe1f35e2c86ddefc420c840.exe	28
PID 1936 wrote to memory of 1856	1936	a4e55b134fe1f35e2c86ddefc420c840.exe	28
PID 1936 wrote to memory of 1856	1936	a4e55b134fe1f35e2c86ddefc420c840.exe	28

C:\Users\Admin\AppData\Local\Temp\a4e55b134fe1f35e2c86ddefc420c840.exe
"C:\Users\Admin\AppData\Local\Temp\a4e55b134fe1f35e2c86ddefc420c840.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 648
  2⤵
  - Program crash
  PID:1856

memory/1936-0-0x0000000000FC0000-0x0000000000FCC000-memory.dmp

Filesize
48KB

Download
memory/1936-1-0x00000000008C0000-0x00000000008DA000-memory.dmp

Filesize
104KB

Download
memory/1936-2-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/1936-3-0x0000000004B60000-0x0000000004BA0000-memory.dmp

Filesize
256KB

Download
memory/1936-4-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/1936-5-0x0000000004B60000-0x0000000004BA0000-memory.dmp

Filesize
256KB

Download