44c344973cf2c047f1db8a5cf02c906e069c10429de5948c892e0355299eed4b

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14-02-2024 02:32

Target

44c344973cf2c047f1db8a5cf02c906e069c10429de5948c892e0355299eed4b.exe
Size

5KB
MD5

6bbc9802f787cad6a0d6c81a7881e78e
SHA1

643d00ac017f88f7f071bcde83f1a14845bc95d6
SHA256

44c344973cf2c047f1db8a5cf02c906e069c10429de5948c892e0355299eed4b
SHA512

3f783bbaf88fcd143271759304a1ec63306fdc81d4d6f2d0f38fa508b7f9fd4b16244fd6cdd8cf53baa75590b6dd644e76ddf1ba92bbbb5e1d2b4e75c0c4860b
SSDEEP

48:SOlXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7tsRuqSxp:TWLkFfNnOKYloIQ2pm2pbYSIxE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2188	2620	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2188	2620	44c344973cf2c047f1db8a5cf02c906e069c10429de5948c892e0355299eed4b.exe	28
PID 2620 wrote to memory of 2188	2620	44c344973cf2c047f1db8a5cf02c906e069c10429de5948c892e0355299eed4b.exe	28
PID 2620 wrote to memory of 2188	2620	44c344973cf2c047f1db8a5cf02c906e069c10429de5948c892e0355299eed4b.exe	28
PID 2620 wrote to memory of 2188	2620	44c344973cf2c047f1db8a5cf02c906e069c10429de5948c892e0355299eed4b.exe	28

C:\Users\Admin\AppData\Local\Temp\44c344973cf2c047f1db8a5cf02c906e069c10429de5948c892e0355299eed4b.exe
"C:\Users\Admin\AppData\Local\Temp\44c344973cf2c047f1db8a5cf02c906e069c10429de5948c892e0355299eed4b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 48
  2⤵
  - Program crash
  PID:2188