4ebebb5318c1dde3462ad1024b60d868ec3667099dab1577fa74c568c0d92bc6

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 06:15

Target

file.exe
Size

2.4MB
MD5

3f039289f2dfb1a6af7e1affff9f9354
SHA1

21b92165dd73f5351a0481fa7811f6149ba4be18
SHA256

4ebebb5318c1dde3462ad1024b60d868ec3667099dab1577fa74c568c0d92bc6
SHA512

061804068e59aba314e3f663b695b07d623085d80bdea82278b78cb5bbceee44ef3a68baf2997863bbf772636230bafcbb7a963c76658ef7468703eccdac1cf7
SSDEEP

49152:PkQTAsQ8XADM8dDGbMtR8ugY+UsFS7z1BQ8zDUtemAavNgX:Pas3ohwbw8MlQk1y8KBgX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2584	1772	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 2584	1772	file.exe	29
PID 1772 wrote to memory of 2584	1772	file.exe	29
PID 1772 wrote to memory of 2584	1772	file.exe	29
PID 1772 wrote to memory of 2584	1772	file.exe	29

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 548
  2⤵
  - Program crash
  PID:2584

memory/1772-1-0x0000000074A10000-0x00000000750FE000-memory.dmp

Filesize
6.9MB

Download
memory/1772-0-0x0000000005120000-0x000000000536A000-memory.dmp

Filesize
2.3MB

Download
memory/1772-2-0x0000000004E90000-0x0000000004ED0000-memory.dmp

Filesize
256KB

Download
memory/1772-3-0x0000000004E90000-0x0000000004ED0000-memory.dmp

Filesize
256KB

Download
memory/1772-4-0x0000000004ED0000-0x0000000005118000-memory.dmp

Filesize
2.3MB

Download
memory/1772-7-0x00000000028E0000-0x00000000048E0000-memory.dmp

Filesize
32.0MB

Download
memory/1772-8-0x0000000074A10000-0x00000000750FE000-memory.dmp

Filesize
6.9MB

Download
memory/1772-9-0x0000000004E90000-0x0000000004ED0000-memory.dmp

Filesize
256KB

Download
memory/1772-10-0x0000000004E90000-0x0000000004ED0000-memory.dmp

Filesize
256KB

Download
memory/1772-11-0x0000000004E90000-0x0000000004ED0000-memory.dmp

Filesize
256KB

Download
memory/1772-12-0x00000000028E0000-0x00000000048E0000-memory.dmp

Filesize
32.0MB

Download