e30d2dc78fcfc5085fc9bcb7238b06cb345373fe97f19f417a477a380dfc53fc

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 15:37

Target

a426be45ef7c0ada782eefd8766029e1.exe
Size

164KB
MD5

a426be45ef7c0ada782eefd8766029e1
SHA1

c5bfe2e9b94c0a7e357aaf3fecd385a1d0f698e6
SHA256

e30d2dc78fcfc5085fc9bcb7238b06cb345373fe97f19f417a477a380dfc53fc
SHA512

49def47eec8f75b2ad9e3abe1dbfc53ccab4c266000ceb00bdc72f1ac805a565dd53e2165169d69dc8254ee458d293fa1c55cb6d165153f0352cfa05fce28246
SSDEEP

3072:gICReUqh0TbDrRj+z0tsBVD9zcgJOz9Kf1YbUH4HZHMv6qJJJgX2XKe:gICRnM0TbZj+wtmzSz9Kf1i64HZHMv64

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	2508	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1728	2508	a426be45ef7c0ada782eefd8766029e1.exe	28
PID 2508 wrote to memory of 1728	2508	a426be45ef7c0ada782eefd8766029e1.exe	28
PID 2508 wrote to memory of 1728	2508	a426be45ef7c0ada782eefd8766029e1.exe	28
PID 2508 wrote to memory of 1728	2508	a426be45ef7c0ada782eefd8766029e1.exe	28

C:\Users\Admin\AppData\Local\Temp\a426be45ef7c0ada782eefd8766029e1.exe
"C:\Users\Admin\AppData\Local\Temp\a426be45ef7c0ada782eefd8766029e1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 148
  2⤵
  - Program crash
  PID:1728

memory/2508-0-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download