470dd765bf385fdcaa39faaae847847f30b3bfe8040cf07bc8b6e5905dc9c09f

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29/02/2024, 06:45

Target

adf033a9e1cc5997122111d440f06278.exe
Size

13KB
MD5

adf033a9e1cc5997122111d440f06278
SHA1

019a917feb095d9d02d618952cc8eb6ec62ffd40
SHA256

470dd765bf385fdcaa39faaae847847f30b3bfe8040cf07bc8b6e5905dc9c09f
SHA512

f89c285e67f4a5180fc1e6bdfd3092b57606e4a5faec6dedee1f424ab1462b8c16632a1fdd17d708855ae93399bc0d74ccd51f4e34b342f65986a9ba82363180
SSDEEP

384:czsZ5bve1pUndijzNknyYGVVOW1uu/uRjvQljXM54Ha7:ZvdivNo8VVOsuquVsjch7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1900	2016	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1900	2016	adf033a9e1cc5997122111d440f06278.exe	28
PID 2016 wrote to memory of 1900	2016	adf033a9e1cc5997122111d440f06278.exe	28
PID 2016 wrote to memory of 1900	2016	adf033a9e1cc5997122111d440f06278.exe	28
PID 2016 wrote to memory of 1900	2016	adf033a9e1cc5997122111d440f06278.exe	28

C:\Users\Admin\AppData\Local\Temp\adf033a9e1cc5997122111d440f06278.exe
"C:\Users\Admin\AppData\Local\Temp\adf033a9e1cc5997122111d440f06278.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 36
  2⤵
  - Program crash
  PID:1900

memory/2016-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2016-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download