469d9e98803701be443ab088f24d9e15a9fdb80e1f3a84feb7ddf92486f0773c

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 01:02

Target

981420c30c39594e034e6033ff212666.exe
Size

92KB
MD5

981420c30c39594e034e6033ff212666
SHA1

650b936b99ecfc105c55748c81cc8bff8bd827a6
SHA256

469d9e98803701be443ab088f24d9e15a9fdb80e1f3a84feb7ddf92486f0773c
SHA512

75db850b458843dd2cfda4b6dcbde31573d0704503cc5b07723b8566526b73f941ceaa8a07a980e2fbe62452d0e5484aa01b737612480f6fd68358095b7b4dda
SSDEEP

1536:HlhYWl8pj7w1hN8hpMcTrY4x9C+RXaumAI5aVQkYcsx3eM+42+j8ou4JlI8lDtW:FLl8euMAY4x9nXJmZ5o8On68ou4JlIgo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1044	2012	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1044	2012	981420c30c39594e034e6033ff212666.exe	28
PID 2012 wrote to memory of 1044	2012	981420c30c39594e034e6033ff212666.exe	28
PID 2012 wrote to memory of 1044	2012	981420c30c39594e034e6033ff212666.exe	28
PID 2012 wrote to memory of 1044	2012	981420c30c39594e034e6033ff212666.exe	28

C:\Users\Admin\AppData\Local\Temp\981420c30c39594e034e6033ff212666.exe
"C:\Users\Admin\AppData\Local\Temp\981420c30c39594e034e6033ff212666.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 152
  2⤵
  - Program crash
  PID:1044

memory/2012-0-0x0000000001011000-0x0000000001018000-memory.dmp

Filesize
28KB

Download