161a75aff5149ca463314a34424ced138e754ef61741589e307cc79e5bacba34

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 18:00

Target

a46dcb5d97dc174e2112a09993806e24.exe
Size

126KB
MD5

a46dcb5d97dc174e2112a09993806e24
SHA1

ec22c40540dfa4e77cc04222fa02662257b3c096
SHA256

161a75aff5149ca463314a34424ced138e754ef61741589e307cc79e5bacba34
SHA512

edae647c89adc6725d5ab6ed79a2c4a5b0cdb8cf07f4663454105478a4d1fe53e97eceda34d2b036332afacd21ee103cd52ff8cce97b57d3ca5d1b284cbf0c2b
SSDEEP

3072:ewBAODwmASra5wV89gZJQ2mCqtupZr5i0YAfLS9FpcwmA0:Dp2s89j2mdQpvNxp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2156	2524	WerFault.exe	9

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2156	2524	a46dcb5d97dc174e2112a09993806e24.exe	28
PID 2524 wrote to memory of 2156	2524	a46dcb5d97dc174e2112a09993806e24.exe	28
PID 2524 wrote to memory of 2156	2524	a46dcb5d97dc174e2112a09993806e24.exe	28
PID 2524 wrote to memory of 2156	2524	a46dcb5d97dc174e2112a09993806e24.exe	28

C:\Users\Admin\AppData\Local\Temp\a46dcb5d97dc174e2112a09993806e24.exe
"C:\Users\Admin\AppData\Local\Temp\a46dcb5d97dc174e2112a09993806e24.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 36
  2⤵
  - Program crash
  PID:2156

memory/2524-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2524-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download