41d7253ab0d4f1ff8b3a76d420212dd98fa58421c5ec9dd54f8615d6316c0ac0

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 03:29

Target
a81adbf226541ece20dfd6b8cd47a2f5.exe
Size 172KB
Sample240227-d176saff3v
SHA256 41d7253ab0d4f1ff8b3a76d420212dd98fa58421c5ec9dd54f8615d6316c0ac0
MD5 a81adbf226541ece20dfd6b8cd47a2f5
SHA1 4ee0d36808c57aaf2e28607e4dcd7ad9bfb7e76f
SHA512 60c540b6708639eb6b7d9a4ec814f7eb99c15c59afe160ad65e9e2e606cb05d95a19a0631cc07f53b94d9197ba8696a6accfc40e6dbefba93f6b7988a8f5ac6d
SSDEEP 3072:4gXdZC9P6D3XJnceAdc2Dkd71l40XAyYigO/3xPfQfgBaQ1sOMsm4VOw:4ew4xmdnIhn40wogO/mIBtsfGVOw
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2288	1540	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 2288	1540	a81adbf226541ece20dfd6b8cd47a2f5.exe	28
PID 1540 wrote to memory of 2288	1540	a81adbf226541ece20dfd6b8cd47a2f5.exe	28
PID 1540 wrote to memory of 2288	1540	a81adbf226541ece20dfd6b8cd47a2f5.exe	28
PID 1540 wrote to memory of 2288	1540	a81adbf226541ece20dfd6b8cd47a2f5.exe	28

C:\Users\Admin\AppData\Local\Temp\a81adbf226541ece20dfd6b8cd47a2f5.exe
"C:\Users\Admin\AppData\Local\Temp\a81adbf226541ece20dfd6b8cd47a2f5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 164
  2⤵
  - Program crash
  PID:2288

memory/1540-0-0x0000000000400000-0x0000000000457000-memory.dmp

Download