e355b0f496cbac670d03e8cfccb89458473ced70a968ef6d748826ed69e9a516

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 15:34

Target

c0f32a16824ad8f75689e40853df4662.exe
Size

123KB
MD5

c0f32a16824ad8f75689e40853df4662
SHA1

b42eeb91a6bc585b196b9e670cc3167b8c3a7b88
SHA256

e355b0f496cbac670d03e8cfccb89458473ced70a968ef6d748826ed69e9a516
SHA512

ae5773f077c30a777aa947f56c151792a26409a00c4eb8e32275d59a37da516e43ac9fd22e46f5335740e1d47c0566418c4c96d664a1005402c7d06ac00984c8
SSDEEP

1536:NMYJ1ZZEuFRH5mdtyKNCp2yGwEzbR50IZROjl91q7i8aEU0vXF1/xSXxw4VZHR+F:9TFFXLawYLP3Ojl91IXUQX3IpZHkEFa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1772	1968	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1772	1968	c0f32a16824ad8f75689e40853df4662.exe	28
PID 1968 wrote to memory of 1772	1968	c0f32a16824ad8f75689e40853df4662.exe	28
PID 1968 wrote to memory of 1772	1968	c0f32a16824ad8f75689e40853df4662.exe	28
PID 1968 wrote to memory of 1772	1968	c0f32a16824ad8f75689e40853df4662.exe	28

C:\Users\Admin\AppData\Local\Temp\c0f32a16824ad8f75689e40853df4662.exe
"C:\Users\Admin\AppData\Local\Temp\c0f32a16824ad8f75689e40853df4662.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 36
  2⤵
  - Program crash
  PID:1772

memory/1968-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1968-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download