9a3249c461e610e62fb2cdbfb38f2d986920aaaa032ffa7ad6cf21e42762d435

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 18:40

Target

c153bc5c148a17bc332c1431a48b5aef.exe
Size

54KB
MD5

c153bc5c148a17bc332c1431a48b5aef
SHA1

b03a15c2d3da5c347a3c4116b176538d63584d40
SHA256

9a3249c461e610e62fb2cdbfb38f2d986920aaaa032ffa7ad6cf21e42762d435
SHA512

bb295812052ffdda7bf35f07a3172b4be15dcc485fb145741ba37d0bdb9474963fff69c7899a31d70a260ae11810a9ff107d1439a30d33aacd19a18f690c4859
SSDEEP

768:co15N5/ija+1I2j2qLp6NqMiFsZdjkoG+DpaavlVcy5U8ad4eQCRWsS8RaguOrx4:co15MzLpvuwjavf5UpLQCRvsmV4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1612	1624	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1612	1624	c153bc5c148a17bc332c1431a48b5aef.exe	28
PID 1624 wrote to memory of 1612	1624	c153bc5c148a17bc332c1431a48b5aef.exe	28
PID 1624 wrote to memory of 1612	1624	c153bc5c148a17bc332c1431a48b5aef.exe	28
PID 1624 wrote to memory of 1612	1624	c153bc5c148a17bc332c1431a48b5aef.exe	28

C:\Users\Admin\AppData\Local\Temp\c153bc5c148a17bc332c1431a48b5aef.exe
"C:\Users\Admin\AppData\Local\Temp\c153bc5c148a17bc332c1431a48b5aef.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 88
  2⤵
  - Program crash
  PID:1612

memory/1624-0-0x0000000044440000-0x0000000044457000-memory.dmp

Filesize
92KB

Download