558415461ba35b1030d08f350fc07c2306b7ef833c1d1b0acacd20822bea06e7

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 13:45

Target

9992e25173a67c7aa14d90537379fc6e.exe
Size

335KB
MD5

9992e25173a67c7aa14d90537379fc6e
SHA1

a4be822feb0baef3484515e6e51b0c115bc20f67
SHA256

558415461ba35b1030d08f350fc07c2306b7ef833c1d1b0acacd20822bea06e7
SHA512

b6a1eb59b6b5b83544cf8e06ec074d2c77cbed5eec46d96dced91421c5355078d1bcf6f734c0c9420c930fc0b2faaeb6cfcb5d77f770533bc9c30c66da2bbcbd
SSDEEP

6144:5e2ryXs/1WF/G70kyhzT2jThzQahhuxLLv8qPW7NcAofDb+MxL3118b+JCnJlaNL:5e2r/9XwhzTkThzQ1v8qPWhofLl9AnJU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1776	2000	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1776	2000	9992e25173a67c7aa14d90537379fc6e.exe	17
PID 2000 wrote to memory of 1776	2000	9992e25173a67c7aa14d90537379fc6e.exe	17
PID 2000 wrote to memory of 1776	2000	9992e25173a67c7aa14d90537379fc6e.exe	17
PID 2000 wrote to memory of 1776	2000	9992e25173a67c7aa14d90537379fc6e.exe	17

C:\Users\Admin\AppData\Local\Temp\9992e25173a67c7aa14d90537379fc6e.exe
"C:\Users\Admin\AppData\Local\Temp\9992e25173a67c7aa14d90537379fc6e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 192
  2⤵
  - Program crash
  PID:1776

memory/2000-0-0x0000000000400000-0x00000000004F1000-memory.dmp

Filesize
964KB

Download
memory/2000-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2000-1-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2000-3-0x0000000000400000-0x00000000004F1000-memory.dmp

Filesize
964KB

Download
memory/2000-5-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download