4154dfcc660e60f7b39701e3d3da0421bd385536a51e8e39dd8bc30ebe480742

Analysis

max time kernel
142s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 04:21

Target

c27072e0c443464bde84f6f13e67b9e3.exe
Size

132KB
MD5

c27072e0c443464bde84f6f13e67b9e3
SHA1

1c0b146c15cd6d1b1ee72f8faff801ca64cf37ab
SHA256

4154dfcc660e60f7b39701e3d3da0421bd385536a51e8e39dd8bc30ebe480742
SHA512

7b6fba8e2ed0e32fa299aed642775ef89c298f75e7528dc034892451a2f71426a1169640e8c55c30ecdbc34be5f839083a642720946639f70118e2c1cabeb695
SSDEEP

3072:8jgvr1AuyXCeJfW3izs/xC5017GqDs8Hz4lTf4oo/U0WU9:USr1TyCyIxCk0lTf4p

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2492	2944	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2492	2944	c27072e0c443464bde84f6f13e67b9e3.exe	28
PID 2944 wrote to memory of 2492	2944	c27072e0c443464bde84f6f13e67b9e3.exe	28
PID 2944 wrote to memory of 2492	2944	c27072e0c443464bde84f6f13e67b9e3.exe	28
PID 2944 wrote to memory of 2492	2944	c27072e0c443464bde84f6f13e67b9e3.exe	28

C:\Users\Admin\AppData\Local\Temp\c27072e0c443464bde84f6f13e67b9e3.exe
"C:\Users\Admin\AppData\Local\Temp\c27072e0c443464bde84f6f13e67b9e3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 96
  2⤵
  - Program crash
  PID:2492

memory/2944-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download