71a15f4217c5532e5e535a1134bb1ea222c4501a10aac79bbb77d32c73704aff

Analysis

max time kernel
119s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 23:39

Target

c1e671563b16d8517228aed95ca2384e.exe
Size

8KB
MD5

c1e671563b16d8517228aed95ca2384e
SHA1

648f42bd2e7a3513ee3660338c72bd6e5d7a42a0
SHA256

71a15f4217c5532e5e535a1134bb1ea222c4501a10aac79bbb77d32c73704aff
SHA512

f1595fefda079bbfc7fa9d53c33d89dbf4ce6e9d04cbf64a8023551f01a093b0979d3fc9233c4549b14e6561afef936c831d942481fe454fa10967bac8302db3
SSDEEP

48:Zvt4+5dByjHvQeBBsNIrP4aQkDS/ZWw/BUY2m9pv14SWN7Xmz:Z1BUPNBBP5rDS/ZWw/BUOX1t2XK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2632	1240	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 2632	1240	c1e671563b16d8517228aed95ca2384e.exe	27
PID 1240 wrote to memory of 2632	1240	c1e671563b16d8517228aed95ca2384e.exe	27
PID 1240 wrote to memory of 2632	1240	c1e671563b16d8517228aed95ca2384e.exe	27
PID 1240 wrote to memory of 2632	1240	c1e671563b16d8517228aed95ca2384e.exe	27

C:\Users\Admin\AppData\Local\Temp\c1e671563b16d8517228aed95ca2384e.exe
"C:\Users\Admin\AppData\Local\Temp\c1e671563b16d8517228aed95ca2384e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 36
  2⤵
  - Program crash
  PID:2632

memory/1240-0-0x0000000000400000-0x0000000000401F5B-memory.dmp

Filesize
7KB

Download