2475ce1afc600fc181b6902e74c4a1fc0b4e79856bc14ac058e411034c97e9d8

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 11:16

Target

be783a917cc71af3cfdb5901064d4bc2.exe
Size

104KB
MD5

be783a917cc71af3cfdb5901064d4bc2
SHA1

5785fa2addbbd2a3adec9d2c3cddda3d0c8bcf4b
SHA256

2475ce1afc600fc181b6902e74c4a1fc0b4e79856bc14ac058e411034c97e9d8
SHA512

c0ea1c79b3d672285e2aa039c26164989824a679a2ff6c9f6c5059ce68552aea1637abfea17209bdf6cb9048960ff1d5bb1a3313e8d7d1412fa8c2fd79f47f85
SSDEEP

3072:hqUwD12zi9CEXeEE7N/QKBbVlvpjmg/vjlLKLTr1gc7F:DiUi9Y37R5vvVTlLaTrhh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1932	1988	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1932	1988	be783a917cc71af3cfdb5901064d4bc2.exe	28
PID 1988 wrote to memory of 1932	1988	be783a917cc71af3cfdb5901064d4bc2.exe	28
PID 1988 wrote to memory of 1932	1988	be783a917cc71af3cfdb5901064d4bc2.exe	28
PID 1988 wrote to memory of 1932	1988	be783a917cc71af3cfdb5901064d4bc2.exe	28

C:\Users\Admin\AppData\Local\Temp\be783a917cc71af3cfdb5901064d4bc2.exe
"C:\Users\Admin\AppData\Local\Temp\be783a917cc71af3cfdb5901064d4bc2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 148
  2⤵
  - Program crash
  PID:1932

memory/1988-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download