43f83b07c714d488bf18c268e556a78734b4cfd906df752762029ca29fad6889

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 11:39

Target

abcc281c289980ae6d17405148667446.exe
Size

40KB
MD5

abcc281c289980ae6d17405148667446
SHA1

6332f333c8085c11ab25d1fc5926bee7dd05a761
SHA256

43f83b07c714d488bf18c268e556a78734b4cfd906df752762029ca29fad6889
SHA512

608c9a960a429169449cec717ae17d75f8b21bb904af66ac7af0c54b7197b3e76cd128716896dcc747ab7e86defb633f83b54205fde1740a048b9c53d4fc0732
SSDEEP

768:zc6NV1/YissZ7tKiTkehMo7w4fWLEc+NkMFixRUGCLi6ptgR0aeFPKtAY:fNV1/YpsV9TnMo820syMFixRIp6R0nQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2932	2968	WerFault.exe	7

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2932	2968	abcc281c289980ae6d17405148667446.exe	28
PID 2968 wrote to memory of 2932	2968	abcc281c289980ae6d17405148667446.exe	28
PID 2968 wrote to memory of 2932	2968	abcc281c289980ae6d17405148667446.exe	28
PID 2968 wrote to memory of 2932	2968	abcc281c289980ae6d17405148667446.exe	28

C:\Users\Admin\AppData\Local\Temp\abcc281c289980ae6d17405148667446.exe
"C:\Users\Admin\AppData\Local\Temp\abcc281c289980ae6d17405148667446.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 36
  2⤵
  - Program crash
  PID:2932

memory/2968-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download