f45ddb9af7ae5acbe263a265ca97c3216c76625e222c98f370157b3ccc192dd0

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 22:35

Target

c1c71c52ae285ca311962a6a9ee6b043.exe
Size

590KB
MD5

c1c71c52ae285ca311962a6a9ee6b043
SHA1

94657f4476e69cb07a82463e1733933af21b9133
SHA256

f45ddb9af7ae5acbe263a265ca97c3216c76625e222c98f370157b3ccc192dd0
SHA512

f5c2914aa923004d83dbf997d4fe2a1299af78c3690978432c52acceca24cb06783a24dcc46a393f173a6fdd4d88eece6ead66c2f2201891d21fcc75ce279405
SSDEEP

12288:8DyHX27ggfoOaBO9NMlqpShhLCmmdI28ecMBE3Yt9/hmg7qjU:8Dy30fohIQbLWUPw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3020	2972	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 3020	2972	c1c71c52ae285ca311962a6a9ee6b043.exe	28
PID 2972 wrote to memory of 3020	2972	c1c71c52ae285ca311962a6a9ee6b043.exe	28
PID 2972 wrote to memory of 3020	2972	c1c71c52ae285ca311962a6a9ee6b043.exe	28
PID 2972 wrote to memory of 3020	2972	c1c71c52ae285ca311962a6a9ee6b043.exe	28

C:\Users\Admin\AppData\Local\Temp\c1c71c52ae285ca311962a6a9ee6b043.exe
"C:\Users\Admin\AppData\Local\Temp\c1c71c52ae285ca311962a6a9ee6b043.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 208
  2⤵
  - Program crash
  PID:3020

memory/2972-0-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2972-1-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2972-3-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download